Cloud Security Analyst (GRC)

About This Opportunity: The role of Docebo’s Security Compliance Analyst II is focused on demonstrating the business value of solid compliance and security programs to prospects and customers, working closely with the Sales & Legal teams so that the Company's Cybersecurity posture will improve customer experience and unlock business value. It is essential to ensure that Docebo adheres to regulatory frameworks and maintains robust security measures. Collaborating with internal teams and external stakeholders, they effectively address compliance and security requirements, safeguarding the company's operations and reputation. This role involves continuous improvement efforts and updating on emerging compliance regulations, security threats, and industry best practices. The Security Compliance Analyst also provides training and guidance to internal teams on compliance requirements and security protocols. Reports to: Business Enablement Manager - Security Location: Biassono (hybrid) Responsibilities: Customer Engagement and Response: respond to customers’ security and privacy-related inquiries, compile comprehensive responses (mainly RFI, RFP, and RFQ), and address compliance questionnaires, ensuring timely and accurate information dissemination and actively supporting the sales process. Customer Audit Support and Documentation: Coordinate Docebo’s activities related to customer compliance audits, assist with agreement and term reviews, and prepare management reports on compliance and security initiatives in collaboration with the GRC team. Support Internal Compliance Management: maintain internal compliance documentation, and coordinate the conduction of risk assessments and internal company audits to ensure organizational readiness in collecting the needed evidence. Vendor Risk Assessment and Monitoring: Support the evaluation of company third-party vendor-associated risks, monitor security controls, and maintain risk management reporting dashboards to mitigate risk and effectively qualify company suppliers; in collaboration with the GRC team. Security Awareness: develop and coordinate the implementation of security & privacy awareness programs to promote a culture of security consciousness; in collaboration with the GRC team. Cross-functional collaboration: collaborate across the company departments to align compliance, security, and privacy efforts with business objectives; consult the company's departments to assess changes and compliance obligations and support updating company compliance programs and controls. Documentation and Reporting: Maintain comprehensive documentation of compliance activities, including policies, procedures, and audit findings, and prepare reports for management and regulatory authorities; in collaboration with the GRC team. Trust Page management: support the definition of content, and keep it updated. Gather information regarding clients' and prospects' requests related to the content of the Trust Page to offer expertise and feedback to other departments to ensure that the content is relevant and up to date with the latest standards. Requirements: Fluent knowledge of English, working experience with contracts and documentation in English, and effective communication and presentation skills. 4 years of relevant work experience. Working experience supporting audits and compliance & security activities for SaaS companies. Working knowledge of information security principles, trends, and best practices, specifically cloud environments and services (eg: AWS, Azure, GCloud). Knowledge of GDPR requirements and other data privacy laws (eg: CCPA, PIPL). Knowledge of ISO/IEC 27001, ISO/IEC 27017, ISO/IEC 27018, ISO/IEC 27701, ISO 9001, and AICPA/ISAE 3000 SOC 2 & PCI. Knowledge of CFR21 Part 11. Nice to have: Bachelor's degree in computer science, information security, auditing, law, or similar. Certified Information Systems Auditor (CISA). Certified Information Privacy Professional (CIPP, IAPP or CIPT). CompTIA Security. Proficiency in tools such as Drata, RFP.io, and similar. Working experience implementing, evaluating, and assessing cybersecurity and compliance standards for the National Institute of Standards and Technology (NIST) or FedRAMP to further the assessment and secure operation of the FedRAMP cloud-based systems. J-18808-Ljbffr

Location: Provincia di Milano, IT

Posted Date: 11/13/2024