Security and Compliance Manager

Have you run SOC 2 and ISO 27001 or similar audits end to end, kept a corporate risk register alive, and negotiated security terms with enterprise customers in regulated industries, preferably in a tech company? Do you reach for establishing functional workflow when a compliance process comes back for the third time? Join our Information Security team and take over the day-to-day running of our security compliance team and Governance, Risk, and Compliance (GRC) program.

Reporting to the CISO, this role offers you the opportunity to participate in building and maintaining Ataccama ISMS, work across departments, represent the security program externally to our auditors and customers, and help ensure that our organization continues to meet evolving regulatory and industry standards. You will cooperate with our Cloud and App Security, Engineering, Cloud Operations, Product Management as well as internal IT on making sure our security compliance standards are not just defined and communicated, but practically implemented, automated, proactively monitored and reported.

Your Challenge

• Run our security compliance program day to day: own the audit calendar, keep the control framework current, manage the security and compliance risks and prepare the materials that feed executive-level reporting and governance forums.
• Coordinate internal and external audits (SOC 1, SOC 2 Type II, ISO 27001:2022 and customer-driven assessments), including evidence collection, auditor logistics, and tracking of findings through to remediation with control owners.
• Operate the corporate risk management program: maintain the risk register, facilitate periodic risk assessments with control owners, prepare quarterly risk reporting (NIST CSF 2.0 based), and surface cross-departmental risks for treatment decisions.
• Maintain the ISMS policy and standards library: author and revise core policies, coordinate scheduled reviews with control owners, and keep them current against regulatory obligations (GDPR, NIS2/ZoKB, EU AI Act, CRA) and customer-driven frameworks (GxP, DORA, FFIEC, NERC CIP, PCI DSS).
• Review security terms in customer contracts, security schedules and addenda with enterprise and regulated-industry customers, together with Legal.
• Manage the RFx and customer security questionnaire process: operate the workflow against established quality standards, direct the specialists and interns answering questionnaires, and act as senior reviewer for high-stakes prospect and customer submissions.
• Assess and onboard new compliance standards and regulations: control mappings, gap analyses and remediation plans in coordination with Engineering, Cloud Operations and IT. Support customer assurance commitments for regulated customers, including GxP validation lifecycle artifacts and Quality and Security Agreements.
• Build and maintain internal GRC so the team scales its output without adding headcount.
• Provide input into incident response and vendor risk management: vendor due diligence, incident playbooks and cost analysis, and customer notifications.
• Manage a small team of compliance specialists and interns, including work supervision, task allocation, quality review, mentoring and hiring.
• Help drive security awareness and training initiatives, including secure use of AI tools across the company.
• Liaise with stakeholders across Cloud and App Security, Engineering, Legal, Sales and Customer Success on compliance-impacting topics, translating between the audit, technical and business worlds for non-specialist audiences.

Is This You?

• 3+ years of experience in information security, GRC, IT audit or compliance
• Able to grasp both business and technical concepts, and distill what matters.
• Hands-on with standards and frameworks such as ISO 27001, SOC 2 and NIST CSF, and with at least one customer-driven framework (GxP, DORA, FFIEC, NERC CIP or PCI DSS).
• Capable of reading and interpreting legal and regulatory texts, with working knowledge of data privacy and cybersecurity regulation (GDPR, NIS2/ZoKB, EU AI Act, CRA).
• A builder: when a compliance task comes back for the third time, you script it, automate it or build a scalable workflow, and you use AI tools responsibly and can set guardrails for others.
• Technically fluent enough to talk to engineers about how a cloud SaaS platform is built and operated (AWS and Azure, Kubernetes, CI/CD, vulnerabilities, identity and access) and about common security threats.
• A strong communicator, comfortable writing policies and documentation, giving presentations, and briefing executives, auditors and customers.
• Proactive, positive, and self-organized: you don't wait to be told what to do, and you are comfortable owning a whole agenda in a small team with few formalities.
• Experience supervising or mentoring specialists or interns, including hiring.
• Strong written and verbal English communication skills; Czech is a plus for ZoKB and local partners.
• Relevant certifications (e.g., ISO 27001 Lead Auditor or Lead Implementer, CISA, CRISC, CISSP, CIPP/E) are a plus.
• People management skills and experience are welcome.