InfoSec GRC Analyst

Camunda is the enterprise platform for agentic orchestration, enabling organizations to coordinate AI agents, people, and systems across complex, end-to-end business processes. Fully remote and global, we are transforming into an AI-first organisation. About the role: As our Senior InfoSec GRC Analyst, you will join a small, senior, and highly collaborative InfoSec team that lives our FAITH values (Focus, Ambition, Integrity, Talent and Humor). You will own the governance, risk, and compliance side of our security practice: keeping our ISMS healthy, driving our ISO 27001 and SOC 2 audit cycles, reviewing the security requirements our customers put in front of us, and replacing manual compliance work with automation wherever we can. What You’ll Be Doing: - Own and continuously improve Camunda's Information Security Management System (ISMS). - Drive our security audit cycle for ISO 27001, SOC 2, and future frameworks. - Review the information security requirements in customer contracts and redline what we cannot realistically meet. - Lead responses to complex customer security questionnaires. - Run and improve our GRC tooling, adding automation and continuous monitoring. - Take ownership of emerging InfoSec compliance topics such as the Cyber Resilience Act and the AI Act. What You Bring: - Hands on experience implementing and maintaining ISO 27001 and/or SOC 2 certifications. - Substantial experience across information security, risk management, and compliance, ideally in a SaaS or cloud software company. - Practical experience reviewing information security requirements in customer contracts. - Experience working with GRC tools, compliance automation, and continuous monitoring. - Strong project management and collaboration skills. - Ability and/or willingness to use our product. Nice-to-haves: - Software development or scripting ability (AI assisted coding). - Experience planning and running business continuity or disaster recovery testing. - Familiarity with Cyber Resilience Act, the AI Act, or NIS2. - Experience working in a fully remote, async first organisation.