This is an individual contributor role with no initial people-management responsibilities. However, as the risk and compliance function matures, there is a clear opportunity for this role to grow in scope and responsibility.

You’ll work closely with IT, Security, Engineering, Legal, Sales, and Customer teams, acting as a trusted partner in communicating our security posture and ensuring we meet customer and regulatory expectations.

What You'll Do:

• Support customers and prospects by completing technical security questionnaires, risk assessments, and due-diligence requests
• Partner with Sales and Customer teams to explain XBOW’s security controls, architecture, and compliance posture
• Assess and manage third-party and vendor security risk, including reviews of SaaS providers and service partners
• Investigate and resolve alerts to stay compliant with our compliance programmes using the Vanta product.
• Help maintain and improve risk assessment frameworks, methodologies, and documentation
• Track and support remediation of identified risks in collaboration with internal stakeholders
• Contribute to compliance initiatives aligned with frameworks such as SOC 2, FedRAMP 20x, ISO 27001, and ISO 42001
• Maintain clear, well-structured risk registers, policies, and supporting evidence
• Coordinate risk management sessions and processes
• Identify opportunities to streamline and automate risk and compliance processes as the company scales
• Support audits, customer reviews, and internal assurance activities as needed

Skills and Qualifications

Essential:

• 7+ years of experience in risk, compliance, security assurance, or related roles
• Experience in hands-on technical roles for example in Engineering, IT or operational security
• Hands-on experience completing or reviewing technical security questionnaires and customer risk assessments
• Familiarity and experience with common security compliance, and data protection frameworks (e.g. SOC 2, ISO 27001, NIST, GDPR, and HIPAA)
• Experience conducting or supporting vendor / third-party risk assessments
• Strong written communication skills, with the ability to explain complex security concepts clearly
• Highly organized and detail-oriented, with a pragmatic approach to risk
• Comfortable working in a fast-moving, remote-first startup environment
• Familiar with using modern AI tooling to improve productivity whilst managing risk

Advantageous:

• Experience working in a SaaS or security-focused company
• Experience handling Subject Access Requests for GDPR
• Security or risk certifications (e.g. CRISC or CISSP)
• Knowledge of cloud security best practices

What We Offer

• Compensation & Equity: Competitive salary and meaningful stock options.
• Growth: Opportunity to learn from and collaborate with top security and AI experts
• Impact: Work on complex technical challenges that support the foundation of our company
• Remote-First: Work from anywhere, with regular opportunities to meet in person

What Else You Should Know

• Location: Remote UK/EU (all team members are remote but we meet regularly and you’re supported to travel to collaborate with colleagues in person)
• Contract: Full-time.

Hiring Process:

1. Talent Introduction
2. GRC & Security Knowledge Interview
   • A conversation about your practical security and GRC knowledge and how you apply it in day-to-day compliance work.
3. Hiring Manager Interview
4. Final Interview with a member of our leadership team

We’re a security company that builds with AI at the core - so you’ll be protecting a team that moves fast, iterates aggressively, and lives in the command line. If that sounds like your kind of environment, let’s talk.