Governance, Risk and Compliance Analyst (Information Security)

Our Information Security team is a trusted partner to the business, integrating security, privacy, and trust into Talkdesk's operations and customer service. We emphasize practical, scalable controls that safeguard customers and employees while allowing the business to operate swiftly. As Talkdesk leads in Customer Experience Automation, our team is crucial in building and maintaining customer trust in our AI development, deployment, and governance.

Are you someone who prefers to automate controls rather than chase evidence quarterly?

As a GRC Analyst on the Information Security team, you will actively manage Talkdesk's compliance programs from start to finish — overseeing our GRC platform, collaborating with engineering to gather audit evidence, and preparing for new certifications as our customer base grows.

What you'll do

• Manage Talkdesk's GRC platform daily, including control owner assignments, evidence requests, automated test configurations, and exception tracking.
• Maintain integrations between the GRC platform and source systems (cloud providers, identity, ticketing, code repositories) to automate evidence collection wherever possible.
• Identify manual control activities suitable for automation and collaborate with security and engineering teams to implement them.
• Oversee the evidence collection cycle for SOC 2 (Type II), ISO surveillances, recertifications, and HIPAA assessments.
• Work with engineering, IT, HR, and platform teams to gather, validate, and prepare audit artifacts, addressing evidence gaps before they escalate into findings.
• Manage the control library and framework crosswalks (SOC 2, ISO 27001, ISO 27701, ISO 22301, ISO 42001, HIPAA), ensuring mappings are current as standards evolve.
• Conduct initial gap assessments against new frameworks (e.g., FedRAMP Moderate, HITRUST, StateRAMP, ISO 42001 expansions), document control gaps and effort estimates, and support readiness once leadership approves a path forward.
• Track the remediation of any non-conformities to closure.
• Utilize AI-assisted tools (control narrative drafting, evidence summarization, policy review) to minimize manual effort while ensuring output accuracy.
• Maintain compliance documentation in Confluence and track work in Jira for team visibility.
• Foster a culture of compliance — making controls easier to follow than bypass.

Must have

• 2-4 years of experience in GRC, IT audit, or information security operations, preferably in a B2B SaaS environment.
• Working knowledge of common security frameworks (SOC 2, ISO 27001, NIST CSF) and privacy regulations (GDPR).
• Hands-on experience with GRC platforms (e.g., Vanta, Drata, OneTrust, Hyperproof, AuditBoard).
• Comfortable collaborating with engineers: able to read cloud architecture diagrams and discuss IAM, logging, and encryption choices, with basic terminal or cloud console skills.
• Familiarity with the SDLC and the implementation of security controls in CI/CD pipelines.
• Experience with Google Workspace, Confluence, and Jira.
• Understanding of AI security and governance topics (e.g., OWASP Top 10 for LLMs, NIST AI RMF, ISO 42001).
• Excellent written and verbal communication skills, capable of translating compliance requirements into clear, actionable requests for engineering and partner teams.
• Fluent in English (written and spoken).
• Strong analytical and critical-thinking skills.
• Comfortable in fast-paced, high-pressure situations, including audit periods.

Nice to have

• Exposure to ISO 27701, ISO 22301, ISO 42001, HIPAA, FedRAMP, StateRAMP, or HITRUST.
• Experience supporting a new framework certification from gap assessment through the first audit.
• Basic scripting skills (Python, Bash, SQL) for evidence gathering and ad-hoc analysis.
• Experience with AWS or other major cloud providers — audit log fluency, IAM, Config rules.
• Familiarity with additional security standards and frameworks (e.g., NIST 800-53, CIS Benchmarks, OWASP, SANS).
• Relevant certifications such as ISO/IEC 27001 Lead Implementer / Lead Auditor, CISA, CRISC, or CompTIA Security+.
• Bachelor's degree or equivalent experience.

Talkdesk is pioneering a new era of Customer Experience Automation (CXA), redefining how the world’s most admired brands interact with their customers through AI. Our global team of courageous innovators is customer-obsessed, building AI-first solutions that put empathy, trust, and transparency at the center of every interaction. We foster an inclusive culture where diverse perspectives drive our success and every voice belongs. Combining the stability of a global leader with the agility of a disruptor, Talkdeskers are empowered with the autonomy to drive meaningful impact, while giving back to the communities and environment around us.

Talkdesk has been recognized as a Leader in the Gartner® Magic Quadrant™ for Contact Center as a Service (CCaaS) and in the G2 Overall Grid® Reports for AI Agents and Contact Center. With seven consecutive years on the Forbes Cloud 100 and multiple AI Breakthrough awards, there has never been a more exciting time to join us as we shape the future of customer experience automation!

Work Environment and Physical Requirements:

Primarily office-environment work, extended periods of sitting or standing, computer-based work. Limited lifting, and equipment usage limited to computer-related equipment (keyboards, mouse, etc.)

The Talkdesk story hinges on empathy and acceptance. It is the shared goal among all Talkdeskers to empower a new kind of customer hero through our innovative software solution, and we firmly believe that the best path to success for our mission is inclusivity, diversity, and genuine acceptance. To that end, we will hire, promote, work along, cheer for, bond with, and warmly welcome into the Talkdesk family all persons without regard to ethnic and racial identity, indigenous heritage, national origin, religion, gender, gender identity, gender expression, sexual orientation, age, disability, marital status, veteran status, genetic information, or any other legally protected status.