Senior Security Engineer, GRC

OUR MISSION AND WHY IT MATTERS

We are on a mission to make humans the strongest security layer.

Human risk remains one of the biggest vulnerabilities and traditional awareness training is not enough. We take a different approach by combining AI-driven personalization, real threat detection, and behavioral science to actively protect people and organizations.

We don't just simulate risks. We build the tools that detect and stop them.

WHY THIS ROLE MATTERS

Security is the business at Hoxhunt. Enterprise deals pass through a security review, and customers trust us with their people's riskiest moments. Product Security keeps that trust: we address any security concern a product team or a customer raises, and we run the programmes behind our SOC 2 Type 2 report, our ISO 42001 certification programme, the ISO 27001 programme we are building, HIPAA and NIS 2.

The programmes are growing faster than the team. We are adding a Senior Security Engineer, GRC who owns programmes end to end and automates them as they go, so that compliance stays continuous instead of seasonal.

WHAT YOU'LL OWN AND DRIVE

• Compliance programmes: SOC 2 Type 2, ISO 42001, HIPAA and NIS 2, and the ISO 27001 build, are split between you and the existing team; the split is agreed when you join. For yours, you hold the scope, the controls, the evidence, the auditor relationship and the corrective actions. You get the controls built in the teams that own the systems.
• The programmes every control depends on: Policies and their renewal cycle, the risk register and the management risk review, access reviews, and the vulnerability management cadence: triage, routing to owners, SLAs, escalation.
• Automation of what you run: Evidence moves from screenshots to source systems, through Vanta and CI. Checks become code where they can. AI agents draft; you verify and decide what ships.
• Customer answers: Security questionnaires and RFPs, shared within the team: answered from the answer library with input from the owning teams, inside deal timelines, and honest where the sources do not support a yes.
• How the function runs: You sit in audit meetings, management reviews and customer security calls, and you design the cadences, ownership and tooling as the programmes grow.

WHAT SUCCESS LOOKS LIKE

• In your first 3 months you'll: Run the vulnerability and access review cadences without help, run the evidence operations of your programme, and see your first automation remove a manual evidence step.
• By month 6 you'll: Own your programme through its audit cycle, own the policy renewal cycle, ensure the risk programme runs on a cadence, and what you run runs without you.

We hire for growth. Senior is a level you can stay at, and from it the path runs to owning security direction across teams.

WHAT MAKES YOU THRIVE HERE

Three things are non-negotiable

• You want a job where compliance and customer-facing work is the focus.
• You use AI to accelerate everything you do, and you verify what it produces.
• You take charge of your own learning instead of waiting for instructions.

You have

• Around 5 years in security compliance, risk, audit or privacy, in-house, at an audit firm or in consulting. What you have run matters more than the years.
• Owned a certification or attestation cycle end to end: scope, controls, evidence, auditor, findings.
• Knowledge of at least one framework at control level and can argue an interpretation with an auditor.
• Automated part of your work: a GRC platform's integrations or APIs, scripts, or AI agents.
• Run a recurring cadence with teams that do not report to you.
• Told a customer or Sales no under deal pressure, and routed the gap to its owner with a date.
• Written policies people follow and customer answers people sign, in excellent English. Finnish is not required.

You do not need to check every box. If the three non-negotiables are you and most of the rest is, apply and tell us what you are still working on.

BONUS POINTS IF YOU ALSO

• ISO 42001 or other AI governance experience
• Certifications such as ISO 27001 Lead Auditor or Lead Implementer, CISA, CISM or CISSP
• Scripting and familiarity with GCP or GitHub

WHO YOU'LL WORK WITH

Product Security is a small team covering governance, risk and compliance, and application security. You work beside the people who run the programmes today and report to the Director of Product Security. You work daily with SRE and platform engineering, product teams, Legal, Sales and Customer Success, and through the year with our external auditors and penetration testers. Tooling: Vanta, a GCP and GitHub based platform, Linear, and AI agents in daily use.

WHAT YOU CAN EXPECT FROM US

• Compensation: Monthly salary of €5,000 to €7,000 depending on your experience.
• Working ways: We work in a flexible, hybrid work setting. You are expected to visit the Helsinki office at least three days a week.
• High performance meets high humanity: We bring an incredibly driven, high-impact energy to our work, but we leave our egos at the door. You will be surrounded by wildly talented, dedicated colleagues in an environment built on extreme kindness, support, and psychological safety.
• Authentic trust and autonomy: We hire great people and trust them to do great work. You will have the autonomy to take real ownership, drive impact, and shape things early on.
• A product you can be proud of: It is incredibly rare in cybersecurity to build a product that end-users genuinely love. You will join a fast-paced, technically sophisticated team making a real, measurable impact against cybercrime.
• The perks that matter: Alongside this amazing community, you will enjoy extensive healthcare with other benefits and our beautiful office in Helsinki (complete with a gym and swimming pool!).

To ensure your personal data is handled securely and in compliance with GDPR, we only accept applications submitted through our . We cannot process applications sent via other channels, such as email or LinkedIn messages.

RECRUITMENT PROCESS

1. Screening call with Talent Acquisition (30 min, remote)

2. Interview with the Director of Product Security (60 min, remote)

3. Take-home exercise (max three hours of work), then a panel discussion about it (60 min, at the office)

4. Interview with the VP of Engineering (30-60 min, remote)

5. Reference checks and final offer

ABOUT HOXHUNT

Hoxhunt was founded in 2016 by four visionaries. Today we are a global team of +300 amazing Hoxhunters advancing a truly AI-native category leader in human risk management, with key hubs in the United States, the United Kingdom, Singapore, and Finland. We are proud to be an award-winning, fast-growing software company, recognized by G2 and Gartner, named to TIME Magazine's list of the World's Top EdTech Companies, and featured for our innovation in major publications like Fast Company, TechCrunch, Forbes, and Inc.

As a multi-product company, Hoxhunt goes beyond traditional security awareness. We don't just educate employees through frequent, personalized, and behavior-changing cybersecurity training - we also actively build real threat intelligence and response tools that protect organizations against malicious cyberattacks every single day.

Be among the first to know about our open positions. Drop your details in our Talent Community, and we will reach out when there is a match!