GRC Engineer - Platform Team

## What you'll do - Own continuous compliance end-to-end ; SOC 2, ISO 27001, and customer security reviews, keeping us audit-ready year-round rather than scrambling at renewal time. - Manage and evolve the compliance roadmap, prioritizing initiatives against business and customer needs; own Vanta end-to-end, including tasks, documentation, integrations, and automated evidence collection. - Lead quarterly access reviews across all systems in collaboration with IT and Engineering, ensuring findings are tracked through to remediation. - Run vendor risk reviews and DPIAs for new tools (especially AI tooling) and help teams adopt new software quickly without compromising our risk posture. - Serve as the technical voice on customer security questionnaires and DPAs, working alongside Sales and Legal to keep deals moving. - Define and report compliance and risk KPIs to leadership, giving them a clear, ongoing view of our posture and where investment is needed. - Partner with the Security Architect to identify and close gaps between written policy and actual control implementation. ## What you'll bring ), ideally ### Iso 27001 too, from gap analysis through audit and maintenance; familiar with GDPR, PCI DSS, and the EU AI Act. - Deep experience running Vanta (or Drata/Secureframe) as a continuous compliance backbone, not a point-in-time checklist. - Technically hands-on: comfortable scripting against AWS APIs to automate evidence collection, with a solid grasp of software development and security concepts. - A strong writer and communicator who can turn around a 200-row security questionnaire quickly and accurately, and translate fluently between compliance and technical teams. ## How to apply . We collect and process your name, contact details, resume/CV, work history, education, and any other information you submit or that we obtain from publicly available sources or references. How we use your data: We process your personal data to evaluate your candidacy, communicate with you about the recruitment process, comply with legal obligations (such as right-to-work verification), and, with your consent, to consider you for future opportunities. Legal basis (EU/UK applicants): We rely on (i) pre-contractual steps at your request ( ### Gdpr/Uk Gdpr Art.6(1)(b)), (ii) legal obligations (Art. 6(1)(c)), and (iii) our legitimate interest in evaluating candidates (Art.6(1)(f)). Retention: If your application is unsuccessful, we retain your data for 12 months after the recruitment process concludes, unless you consent to longer retention. Successful candidates’ data becomes part of their employment records. Your rights: Depending on your location, you may have the right to access, correct, delete, or restrict the processing of your personal data, to data portability, and to withdraw consent. Automated decision-making: We use automated tools to assist in screening applications. No hiring decision is made solely by automated means without human review. International transfers: Your data may be transferred to and processed in the United States, Germany, the United Kingdom, or Romania. Where required, transfers are protected by Standard Contractual Clauses or other approved mechanisms. By submitting your application, you acknowledge that you have read and understood Taktile’s Applicant Privacy Policy. To exercise your rights or ask questions, contact [email removed] …

See the listing for full requirements.