Senior Security & Compliance Analyst

How We Work

Energy Exemplar is growing fast around 30% year on year and, that growth is driven by how we work. We trust our team to deliver great results from wherever they work best, whether that’s at home, in the office, or on the move.

About the Position

Reporting to the VP, Cloud Operations & GRC, the Sr. Security & Compliance Analyst will support the execution and continuous improvement of Energy Exemplar’s security, risk, compliance, vulnerability management, and AI governance programs across cloud and enterprise operations.

Responsibilities:

• Support security and compliance programs aligned with ISO 27001, SOC 1, SOC 2, privacy, and emerging AI governance requirements.
• Coordinate and drive vulnerability remediation activities across Engineering, Cloud Operations, IT, and Product teams to ensure remediation within defined EE SLAs.
• Track and report security metrics, including MTTR, overdue vulnerabilities, remediation trends, audit findings, and compliance dashboards.
• Proactively follow up and escalate unresolved vulnerabilities, audit findings, and compliance gaps.
• Support continuous control monitoring, risk assessments, third-party risk management, policy management, access reviews, and audit activities.
• Respond to customer security and compliance due diligence requests, audits, and questionnaires.
• Support AI governance, security, and compliance initiatives, including assessment of AI-related risks, emerging regulations, and industry standards (e.g., ISO 42001, EU AI Act, privacy requirements).
• Assist in evaluating AI-enabled solutions and third-party AI services for security, privacy, compliance, and responsible AI considerations.
• Monitor emerging cybersecurity threats, privacy regulations, and industry compliance requirements.
• Collaborate with cross-functional teams to drive remediation and continuous improvement initiatives.

Qualifications:

• 6–8 years of experience in Governance, Risk & Compliance (GRC), cybersecurity, information security, or risk management.
• Strong understanding of ISO 27001, SOC 1 / SOC 2, GDPR/privacy principles, vulnerability management, and security controls.
• Experience in Energy / Utilities sector security and compliance requirements (e.g., CEII or critical infrastructure requirements)
• Experience coordinating vulnerability remediation programs, tracking SLA compliance, MTTR metrics, and executive reporting.
• Experience supporting audits, customer security reviews, and compliance programs.
• Familiarity with emerging AI governance, privacy, and security frameworks (e.g., ISO 42001, EU AI Act, responsible AI principles) preferred.
• Strong communication, organizational, stakeholder management, and follow-up skills.
• Ability to work independently and proactively drive outcomes across distributed teams.

Preferred Certifications:

• CISSP, CISA, ISO 27001 Lead Implementer/Auditor, or similar certifications.
• AI governance/privacy certifications are a plus.