Lead Security Compliance Analyst, (f/m/d)

The Role

This role is based in Berlin. Join us to shape the future of software in the underserved and high‑impact HR technology industry. Your work will have a direct and tangible impact on customers, offering ownership and the chance to make a meaningful difference. As we prepare for significant growth, you’ll face exciting challenges and have the opportunity to influence our path toward becoming one of the world’s leading tech companies. Security is a first‑class priority at Personio. As a Security Compliance Analyst, you will be a key contributor within our Security organization, supporting and extending the work with our Security Compliance Manager to protect the trust our customers and partners place in us. You will lead our technical risk management program, drive internal IT audit activity and support our external audits, and play a hands‑on role in maintaining our current certifications – BSI C5, ISO 27001, and ISO 27017 – while helping to expand our compliance portfolio with new attestations such as SOC 1 and SOC 2. You will work cross‑functionally across Engineering, IT, Legal, and HR, translating complex compliance and risk requirements into clear, actionable programs that scale with Personio’s growth.

What You’ll Do

• Lead technical risk management – maintain and evolve the technical risk register, facilitate recurring risk review cycles with risk owners, and drive risk remediation using Hyperproof as the primary GRC platform.
• Drive internal IT audit activity – draft and conduct internal audit plans, manage findings through to resolution, and maintain a repository of audit evidence and corrective action plans.
• Partner with our Security Compliance Manager – support and continuously improve Personio’s Information Security Management System, aligned with ISO/IEC 27001:2022 and ISO/IEC 27017:2015. Contribute to achieving new attestations (e.g. SOC 1, SOC 2) by coordinating evidence collection, managing control gaps, and interfacing with external auditors.
• Drive compliance reporting – produce regular risk snapshots and audit status updates tailored for a range of stakeholders, from engineering teams to senior leadership, ensuring transparency across the organization.
• Coordinate with stakeholders across the business – partner with teams in Engineering, IT, Legal, and HR to identify control gaps, support audit readiness, and ensure compliance documentation (policies, ISMS, SoA) is current and accurate.
• Apply AI and modern tooling to scale GRC work – leverage LLMs and automation to accelerate tasks such as cross‑standard control mapping, evidence correlation, and compliance gap analysis.

What You Need To Succeed

• 3–5 years of experience in a GRC, information security, or IT risk role, with demonstrated ownership of risk management processes – including risk identification, classification, and driving remediation with risk owners.
• Hands‑on familiarity with ISO 27001 and at least one other recognized framework (e.g. SOC 2, NIST) – including practical experience supporting audits, managing evidence, and working with control requirements. Additional nice‑to‑have experience with German frameworks, e.g. TISAX and BSI C5.
• Audit experience – able to independently draft and execute internal audit plans, document findings, and track corrective actions through to closure.
• Strong stakeholder management skills – comfortable presenting GRC work to both technical and non‑technical audiences, coordinating across multiple teams, and driving compliance activities without direct authority.
• Comfort with AI and LLM tooling – experience using language models to support compliance work (e.g. mapping controls across frameworks, drafting policies, summarizing audit findings) and an appetite to expand this capability.
• Clear written and verbal communication in English – able to translate compliance and risk concepts into clear reporting and documentation for a wide range of stakeholders.

Benefits

• 20 Flex Days per year for remote work and required office presence of 2 days per month.
• Competitive reward package – reevaluated each year – that includes salary, benefits, and pre‑IPO equity.
• 28 days of paid vacation, plus an additional day after 2 and 4 years.
• 1 fully paid Impact Day to make an impact on the environment and society.
• Generous family leave, child support, mental health support, and sabbatical opportunities.
• Health snacks, drinks, and a weekly catered lunch.
• Meals, cultural initiatives, and events such as local Summer Sessions and year‑end celebrations.

Equal Opportunity Statement

Personio is an equal opportunities employer, committed to building an integrative culture where everyone feels welcomed and supported. We embrace uniqueness and understand that our diverse, values‑driven culture makes us stronger. We are proud to have an inclusive workplace environment that will foster your development no matter your gender, civil status, family status, sexual orientation, religion, age, disability, education level, or race.

#J-18808-Ljbffr