Security Analyst (Hybrid)

The Role We are looking for a proactive, detail-oriented, and collaborative Security Analyst with a strong focus on Governance, Risk, and Compliance (GRC) to help evolve and sustain Nitro's global security and compliance posture. This key role is central to ensuring Nitro maintains "always‐on compliance" – embedding governance and control assurance into daily operations. The successful candidate will help maintain and mature Nitro's core compliance programs, including ISO 27001, SOC 2, HIPAA, and DORA, while serving as the primary point of contact (POC) for our external compliance vendor. In addition to managing our compliance frameworks, this role will drive security oversight across Nitro's diverse ecosystem of business‐critical applications, platforms, and integrations – including systems such as Salesforce, Atlassian, Microsoft 365 and other SaaS and cloud‐based services. The analyst will ensure these environments are governed by consistent, effective controls and that security risk is continuously monitored and managed. You'll collaborate across Security Operations, IT, Engineering, Legal, Sales, and Customer Success to ensure Nitro's security practices are robust, transparent, and trusted – both internally and by our customers. What You Will Be Doing Governance, Risk, and Compliance Play a significant role in Nitro's compliance programs (ISO 27001, SOC 2, HIPAA, DORA), ensuring a continuous state of readiness and certification maintenance. Act as the main point of contact for Nitro's external compliance vendor, managing communications, audits, evidence requests, and ongoing improvement initiatives. Implement and champion Nitro's "always‐on compliance" strategy – embedding compliance automation and continuous control monitoring across our systems. Maintain the internal GRC calendar and ensure all compliance activities are completed on schedule. Develop, maintain, and refine security policies, procedures, and standards, ensuring alignment with frameworks and practical applicability. Report on compliance status, control effectiveness, and risks to management and stakeholders. Security Oversight Across Nitro's Applications and Platforms Provide security governance and oversight for Nitro's portfolio of applications, platforms, and integrations – including Salesforce, Atlassian (Jira/Confluence), Microsoft 365, AWS, and other critical SaaS systems. Partner with system owners to ensure security configurations, access controls, and audit logs meet Nitro's standards and compliance requirements. Conduct periodic reviews of key systems to verify proper implementation of controls (e.g., MFA enforcement, data retention, access management, logging). Ensure consistent risk assessment and control validation across both internally managed and third‐party services. Collaborate with IT and Engineering teams to remediate control gaps and strengthen system‐level governance. Develop and maintain an inventory of systems and integrations, tracking ownership, classification, and control coverage. Customer and Sales Support Partner with Sales and Customer Success to respond to security questionnaires, RFPs, and due diligence requests from customers and prospects. Maintain and continuously improve Nitro's Trust and Security documentation, ensuring it reflects our current certifications and controls. Support customer security reviews by clearly articulating Nitro's security and compliance posture. Risk Management and Continuous Improvement Coordinate risk assessments across platforms and business processes; ensure identified risks are tracked and mitigated. Manage and evolve Nitro's vendor risk management program, assessing third‐party partners and integrations. Identify opportunities to streamline and automate compliance activities through tools, integrations, and data‐driven reporting. Collaborate closely with Security Operations to align compliance controls with operational monitoring and incident response capabilities. Stay current on emerging security and regulatory trends, helping Nitro anticipate and adapt to new requirements. What You Must Have 3–5+ years of experience in Information Security, GRC, or Security Assurance roles. Hands‐on experience managing compliance frameworks such as ISO 27001, SOC 2, HIPAA, or DORA. Proven experience liaising with external auditors or compliance vendors. Strong understanding of security governance, risk management, and control frameworks (e.g., ISO, NIST, COBIT). Demonstrated experience with SaaS and enterprise platforms (e.g., Salesforce, Atlassian, Microsoft 365, AWS, Azure or similar). Excellent communication, coordination, and stakeholder management skills. Strong analytical and organizational skills with attention to detail. Experience developing or maintaining security policies, control documentation, and audit evidence. Nice to Have Certifications such as CISA, CISM, CISSP, ISO 27001 Lead Implementer/Auditor, or equivalent. Familiarity with data protection and privacy regulations (GDPR, CCPA). Experience in third‐party risk management or vendor assurance programs. A mindset for continuous improvement and process automation in compliance operations. Prior experience in a SaaS or cloud‐first organization with complex integrations. Benefits Along with our standard benefits and programs (Health, Dental, Vision, and Retirement as standard), we also offer a few additional initiatives. Flex Time Off – Work‐life balance is important; we offer Flex Time Off for holidays, family time, or appointments. Hybrid Work – We combine three days of in‐person collaboration at our global offices in Toronto, Dublin, Antwerp, Porto, and Melbourne with two days of remote work each week. We provide a comprehensive benefits package that includes health insurance, dental and vision coverage, wellness perks, pension/401k matching, and many other country‐specific benefits. Nitro strongly encourages applications from everyone regardless of race, religion, colour, national origin, gender, sexual orientation, age, marital status or disability status. We provide an accessible candidate experience and invite you to request any accommodations or adjustments throughout the interview process and beyond. #J-18808-Ljbffr