Governance, Risk and Compliance Analyst (Information Security)

Title: Governance, Risk and Compliance Analyst (Information Security) Location: Portugal

Our Information Security team is a trusted partner to the business, integrating security, privacy, and trust into Talkdesk's operations and customer service. We emphasize practical, scalable controls that safeguard customers and employees while allowing the business to operate swiftly. As Talkdesk leads in Customer Experience Automation, our team is crucial in building and maintaining customer trust in our AI development, deployment, and governance.

Are you someone who prefers to automate controls rather than chase evidence quarterly?

As a GRC Analyst on the Information Security team, you will actively manage Talkdesk's compliance programs from start to finish — overseeing our GRC platform, collaborating with engineering to gather audit evidence, and preparing for new certifications as our customer base grows.

What you'll do

• Manage Talkdesk's GRC platform daily, including control owner assignments, evidence requests, automated test configurations, and exception tracking.
• Maintain integrations between the GRC platform and source systems (cloud providers, identity, ticketing, code repositories) to automate evidence collection wherever possible.
• Identify manual control activities suitable for automation and collaborate with security and engineering teams to implement them.
• Oversee the evidence collection cycle for SOC 2 (Type II), ISO surveillances, recertifications, and HIPAA assessments.
• Work with engineering, IT, HR, and platform teams to gather, validate, and prepare audit artifacts, addressing evidence gaps before they escalate into findings.
• Manage the control library and framework crosswalks (SOC 2, ISO 27001, ISO 27701, ISO 22301, ISO 42001, HIPAA), ensuring mappings are current as standards evolve.
• Conduct initial gap assessments against new frameworks (e.g., FedRAMP Moderate, HITRUST, StateRAMP, ISO 42001 expansions), document control gaps and effort estimates, and support readiness once leadership approves a path forward.
• Track the remediation of any non-conformities to closure.
• Utilize AI-assisted tools (control narrative drafting, evidence summarization, policy review) to minimize manual effort while ensuring output accuracy.
• Maintain compliance documentation in Confluence and track work in Jira for team visibility.
• Foster a culture of compliance — making controls easier to follow than bypass.

Must have

• 2-4 years of experience in GRC, IT audit, or information security operations, preferably in a B2B SaaS environment.
• Working knowledge of common security frameworks (SOC 2, ISO 27001, NIST CSF) and privacy regulations (GDPR).
• Hands-on experience with GRC platforms (e.g., Vanta, Drata, OneTrust, Hyperproof, AuditBoard).
• Comfortable collaborating with engineers: able to read cloud architecture diagrams and discuss IAM, logging, and encryption choices, with basic terminal or cloud console skills.
• Familiarity with the SDLC and the implementation of security controls in CI/CD pipelines.
• Experience with Google Workspace, Confluence, and Jira.
• Understanding of AI security and governance topics (e.g., OWASP Top 10 for LLMs, NIST AI RMF, ISO 42001).
• Excellent written and verbal communication skills, capable of translating compliance requirements into clear, actionable requests for engineering and partner teams.
• Fluent in English (written and spoken).
• Strong analytical and critical-thinking skills.
• Comfortable in fast-paced, high-pressure situations, including audit periods.

Nice to have

• Exposure to ISO 27701, ISO 22301, ISO 42001, HIPAA, FedRAMP, StateRAMP, or HITRUST.
• Experience supporting a new framework certification from gap assessment through the first audit.
• Basic scripting skills (Python, Bash, SQL) for evidence gathering and ad-hoc analysis.
• Experience with AWS or other major cloud providers — audit log fluency, IAM, Config rules.
• Familiarity with additional security standards and frameworks (e.g., NIST 800-53, CIS Benchmarks, OWASP, SANS).
• Relevant certifications such as ISO/IEC 27001 Lead Implementer / Lead Auditor, CISA, CRISC, or CompTIA Security+.
• Bachelor's degree or equivalent experience.