[Hiring] Security & Compliance Analyst @Graphite

Role Description

We are searching for a mid-level Security & Compliance Analyst to help us keep our security and compliance program at the level our clients expect.

• Support Graphite in its security and compliance efforts through hands-on technical work.
• Maintain strong controls and meet SOC 2 and GDPR commitments.
• Reports to: Director of Legal.
• Works with: Engineering, IT, Legal.
• This is a fully remote work opportunity.

This role requires you to be resourceful, detail-oriented, and calm under pressure. You feel comfortable taking full ownership of your work and collaborating closely with both technical and non-technical teams.

• Monitor and triage security alerts, and escalate real issues.
• Coordinate incident response, from triage through post-mortem, and run tabletop exercises.
• Triage security advisories and vulnerabilities, and track patching against our remediation SLAs.
• Maintain technical security controls, including encryption, key and certificate management, and secrets rotation.
• Review cloud and infrastructure configurations against our security policies, and follow up on fixes.
• Run periodic checks (vulnerability scans, backup restores, access reviews) and collect SOC 2 evidence, including for failing Vanta tests.
• Support vendor security reviews, client security questionnaires and GDPR work.
• Report on the status of alerts, vulnerabilities and open compliance items.

Qualifications

• 3 to 5 years in a security operations, cybersecurity or security engineering role.
• Working knowledge of SOC 2 and GDPR and audit processes.
• Hands-on experience with log analysis, vulnerability management and incident response, including post-mortems.
• Working knowledge of encryption and key and certificate management.
• Experience securing cloud infrastructure on AWS and GCP.
• Nice to have: experience with Vanta or a similar compliance platform, and a certification such as Security+, CySA+ or CISSP (or Associate of ISC2).
• Excellent written and verbal English communication skills.

What You’ll Learn

• Enterprise-Grade Compliance: How a fast-growing company meets the security and compliance requirements of some of the world’s largest and most regulated enterprise clients.
• Audit & Certification: Owning the day-to-day work behind maintaining SOC 2 and GDPR commitments, side by side with Legal and Engineering.
• Emerging Frameworks: Hands-on exposure to new areas like AI governance as the compliance landscape evolves.
• Security at Scale: Building sustainable, repeatable security processes across a fully distributed team.

How We’ll Help

• Process As Needed: Iterative, empowering processes.
• Autonomy: Full ownership and agency to drive projects forward.
• Flexible Work Environment: Distributed team across US, Canada, LATAM, and Europe.
• Compensation: Competitive pay for the best talent.
• Vacation & Time Off: Flexible PTO to recharge.
• Benefits: Quality healthcare coverage and education opportunities.