frontify - Information Security Governance Specialist

• You'll own customer security assurance, ensuring enterprise security questionnaires, due diligence requests, and audit inquiries are handled accurately, consistently, and efficiently, helping customers make informed decisions while supporting commercial success. • You'll drive the day-to-day operation and continuous improvement of our compliance programs, including ISO 27001, SOC 2, TISAX, and emerging regulatory requirements. • You'll serve as the subject matter expert during audits and ensure our control environment remains effective and audit-ready. • You'll help transform compliance from a point-in-time activity into a continuous process by introducing automation and AI into our Vanta-based GRC program. This includes improving evidence collection, control monitoring, and access review processes. • You'll design and improve AI-enabled GRC workflows, leveraging LLMs to streamline policy management, documentation, risk assessments, and other governance activities while ensuring appropriate governance and human oversight. • You'll strengthen Frontify's vendor risk management program by scaling security assessments through automation while ensuring higher-risk vendors receive appropriate human review. • You'll contribute to the continuous improvement of Frontify's security awareness program by helping employees build practical security knowledge rather than simply completing mandatory training. • You’re comfortable working in a hybrid format, with the ability to come to our London office once per week. • You have 5+ years of experience in information security governance, GRC, or technology risk within a SaaS or cloud environment. • You've been the subject matter expert in SOC 2 and/or ISO 27001 audits — not just supporting them, but working directly on controls and partnering with auditors. Experience with additional frameworks such as TISAX or Microsoft SSPA is a plus. • You're hands-on with modern GRC platforms (we run Vanta and Conveyor), and you instinctively reach for automation over manual effort. • You think entrepreneurially, embrace new technologies, and challenge the status quo to drive meaningful improvements. • You're genuinely excited about applying AI to compliance work, and you can tell the difference between where it accelerates you and where human judgment still matters. • You communicate risk clearly to both technical and business audiences, and you enjoy helping those around you do their best work. • A relevant certification (CISA, CISM, CISSP, CIPP, or similar) is a plus. • You speak English fluently. German is a plus. • We understand that every candidate’s experience is different. If you’re interested in this role but don’t tick all the boxes, we still encourage you to apply.