{"id":1606027,"url":"https://alion.io/job/optimizely-senior-compliance-and-risk-analyst","title":"Senior Compliance and Risk Analyst","company":{"id":39533,"name":"Optimizely","domain":"optimizely.com","url":"https://alion.io/company/optimizely","size_band":"1001-5000","is_staffing_agency":false,"employer_type":"direct","is_intermediary":false,"listed_via":null,"ats_vendor":"SuccessFactors","truth_index":null},"role":"Finance","role_family":"Finance","seniority":"senior","employment_type":null,"work_mode":"on_site","remote_scope":null,"remote_scope_basis":null,"remote_working_hours":null,"hiring_geo_confidence":"explicit","locations":["Berlin, Germany"],"countries":["DE"],"hiring_countries":[],"hiring_countries_total":0,"salary":null,"salary_estimate":{"min_usd":79000,"max_usd":139000,"period":"year","method":"role_seniority_country_remote_cell","sample_n":39},"experience_years_min":3,"visa_sponsorship":false,"relocation_package":false,"has_equity":false,"technologies":[{"name":"GDPR","optional":false},{"name":"ISO 27001","optional":false},{"name":"PCI DSS","optional":false}],"status":"live","first_seen_at":"2026-09-07T00:00:00Z","employer_posted_date":"2026-09-07","last_verified_at":"2026-10-19T07:59:22Z","board_verified":true,"closed_at":null,"days_open":42,"trust":{"level":"ok","repost_count":null,"flags":[],"days_open":42},"description":"We're not here to add to the noise. We're here to cut through it- with AI that actually works for marketers.\nFrom AI-powered content creation to world-class CMS and the industry's most trusted experimentation platform, Optimizely is the tool modern marketers actually want to use. AI-Ready. Set. Go.\n10,000+ brands including H&M, PayPal, and Zoom already get it. So do Gartner, Forrester, and IDC, who consistently recognize us as leaders in MarTech.\nBut here's the thing about building great products: it takes great people. Our 1,600+ Optimizers across 12 global offices are curious, collaborative, and refreshingly human. We don't do corporate speak. We do real conversations, big ideas, and genuinely care for the work we make together.\nIf you want to be part of a team that's shaping the future of marketing technology - and actually enjoys doing it - you're in the right place.\nFind us on Instagram: @optimizely\nIntroduction\nWe are looking for an experienced and self-driven Compliance & Risk Analyst to join our global Compliance function. This is a high-impact IC3 role with broad scope, spanning information security certification, PCI DSS compliance, data privacy, and environmental, social, and governance (ESG) programmes.\nThe role is based in Germany and will serve as a key compliance resource for the Campaign product line (which holds its own ISO 27001 certification scope), while also contributing to and helping to manage Optimizely's global PCI DSS v4.0.1 programme. In addition, the successful candidate will oversee and drive Optimizely's companywide ESG programme - a growing area of strategic importance as customers, investors, and regulators increasingly expect demonstrable sustainability and responsible business commitments.\nThis is an individual contributor role at the IC3 level, meaning you will be expected to operate with a high degree of autonomy, bring deep subject matter expertise, and influence outcomes across product, engineering, legal, and commercial teams without direct line management authority. You will report to the Director of Compliance.\nWhat success looks like\nIn the first 90 days you will have a clear picture of the Campaign ISO 27001 ISMS, PCI DSS programme status, and the current state of Optimizely's ESG commitments. You will have built strong working relationships with the Director, Compliance & Risk, Security Engineering, Legal, and relevant product teams, and will have identified the key priorities and gaps to address in your first year.\nAt the 12-month mark, the Campaign ISO 27001 certification will be maintained with clean audit outcomes, the PCI DSS programme will be operating with improved process and evidence quality, GDPR obligations are being managed proactively, and Optimizely will have a published ESG/Sustainability report with a clear roadmap for continuous improvement.\nJob Responsibilities\nCampaign (15%)\nSupport and co-maintain the ISO 27001 Information Security Management System (ISMS) for Campaign, including scope definition, risk treatment, and Statement of Applicability (SoA).\nAct as a supporting contact for Campaign ISMS, collaborating with product, engineering, infrastructure, and Compliance teams to maintain effective, evidenced controls.\nAssist in preparing and managing annual ISO 27001 surveillance and recertification audits, liaising with external auditors.\nConduct scheduled internal audits and management reviews, tracking findings to resolution.\nMaintain and enhance the Campaign scope risk register, ensuring risks are assessed, treated, and reviewed per ISMS policy.\nAlign Campaign ISMS controls with Optimizely's overarching security program and group policies alongside the Director, Compliance & Risk.\nKeep ISO 27001 documentation current, audit-ready, and available for customers via the Trust Center.\nPCI DSS v4.0.1 (25%)\nSupport and co-maintain Optimizely's global PCI DSS v4.0.1 compliance program alongside security engineering and product teams.\nMaintain an accurate Cardholder Data Environment (CDE) scope, including network segmentation docs, data flow diagrams, and system inventories.\nCoordinate the annual AOC/SAQ-D process and manage the Qualified Security Assessor (QSA) relationship.\nTrack and drive remediation of PCI DSS findings, collaborating with engineering and infrastructure teams to meet compliance deadlines.\nMonitor ongoing PCI DSS v4.0.1 requirements to ensure proactive, continuous compliance.\nESG Programme (50%)\nSupport Optimizely's companywide ESG programme, defining the strategy, roadmap, and reporting framework in line with relevant standards and stakeholder expectations.\nDevelop and maintain Optimizely's ESG disclosure frameworks working with ESG platforms like EcoVadis, Novartis, Malk and the Carbon Disclosure Project (CDP).\nCoordinate ESG data collection across the business (including emissions data, diversity metrics, social impact indicators, and governance practices), working with Finance, HR, Facilities, Legal, and Product teams.\nPrepare and publish Optimizely's annual ESG report or equivalent sustainability disclosure, ensuring accuracy, consistency, and alignment with investor and customer expectations.\nRespond to customer ESG questionnaires and ESG rating agency requests (e.g. EcoVadis, CDP, MSCI), managing submissions and coordinating input from subject matter owners.\nBuild and maintain an ESG roadmap, identifying gaps against emerging requirements and tracking progress against commitments.\nEngage internal stakeholders - including the executive team - to embed ESG thinking into business strategy and operational decisions.\nMonitor regulatory developments in ESG and sustainability reporting and advise on implications for Optimizely.\nGDPR and Data Privacy (10%)\nSupport Optimizely’s global data privacy programme, maintaining compliance with GDPR, CCPA, and global privacy laws.\nAssist with operational privacy tasks, including DPIAs, vendor privacy assessments, and DPA workflows.\nMaintain accurate data mapping, Records of Processing Activities (ROPA), and personal data inventories.\nHandle and process Data Subject Access Requests (DSARs) and incoming customer privacy inquiries.\nPartner with engineering, legal, and compliance teams to embed privacy-by-design into product development.\nKnowledge and Experience\nEssential\nProven experience (3-5+ years) managing or significantly contributing to an ISO 27001 ISMS, including audit preparation, internal auditing, and certification maintenance.\nSolid working knowledge of PCI DSS (v4.0.1), including scoping, gap assessment, remediation tracking, and evidence collation for ROC or SAQ processes.\nPractical experience with GDPR compliance, ideally including DPIAs, RoPA maintenance, DPA review, and DSARs.\nExperience managing or contributing to an ESG or sustainability programme, including data collection, reporting, and external disclosure.\nStrong ability to work cross-functionally with technical and non-technical stakeholders, translating compliance requirements into actionable tasks.\nExcellent written and verbal communication skills in English; German language proficiency is mandatory given the location and regulatory environment.\nSelf-directed, highly organized, and comfortable managing multiple concurrent workstreams with competing deadlines.\nBased in Germany, with the right to work in Germany.\nPreferred\nRelevant certifications such as ISO 27001 Lead Auditor or Lead Implementer, CISM, CISSP, PCIP, or equivalent.\nFamiliarity with UK/EU GDPR and other local data protection laws.\nExperience in a SaaS or enterprise technology company, ideally with exposure to multi-product compliance programmes.\nExperience working with external auditors, certification bodies, or QSAs.\nFamiliarity with GRC tooling (e.g. Conveyor, Drata, Vanta, OneTrust, or similar).\nEducation\nBachelor's degree or equivalent experience\nOptimizely is committed to a diverse and inclusive workplace. Optimizely is an equal opportunity employer and does not discriminate on the basis of race, national origin, gender, gender identity, sexual orientation, protected veteran status, disability, age, or other legally protected status.\n#LI-JS1","description_format":"text","description_chars":8149,"description_truncated":false,"requirements":{"experience_years_min":3,"management_years_min":null,"team_size_min":null,"manages_managers":false,"education":null,"security_clearance":false,"languages":[{"language":"German","level":"Advanced (C1)","optional":false},{"language":"English","level":"All levels","optional":false}]},"benefits":[],"hiring_locations":[{"name":"Germany","iso":"DE","kind":"country"}],"hiring_excludes":[],"relocation_offered":false,"industries":["Artificial Intelligence","Commerce","Marketing Automation","Digital Marketing"],"lifecycle":[{"event":"open","at":"2026-10-01T19:50:31Z"}],"visa":[],"liveness":{"score":32,"band":"fade","label":"Fading","p_open":1,"p_active":0.704,"p_room":0.45,"age_days":42,"expected_fill_days":27,"reasons":["conf:2","velocity","win:tail"],"computed_at":"2026-10-19T05:45:15Z"},"pay":null,"html_url":"https://alion.io/job/optimizely-senior-compliance-and-risk-analyst","json_url":"https://alion.io/job/optimizely-senior-compliance-and-risk-analyst.json","meta":{"generated_at":"2026-10-19T10:21:23Z","cache_seconds":300,"methodology":"https://alion.io/methodology","terms":"https://alion.io/terms","contact":"https://alion.io/contact","api":"https://alion.io/developers","about":"Alion is a live layer of people, companies and AI agents: who they are, whether they are real and active right now, what they do and how to work with them, readable by people and by agents and paid per call.","catalog":"https://alion.io/catalog.json","usage":{"tier":"crawler_verified","counted_by":"address","units_charged":1,"used_today":7307,"day_limit":null,"remaining_today":null,"minute_limit":300,"resets_at":"2026-10-20T00:00:00Z"}},"offers":[{"id":"company.slices","title":"One company in depth, by slice","status":"live","price":{"credits":0.02,"usd":0.002,"plus_per_slice":{"credits":0.05,"usd":0.005}},"unit":"per company, plus each slice with data","note":"the employer in depth","call":{"mcp_tool":"get_company","arguments":{"id":39533},"rest":"https://alion.io/mcp/rest/get_company?id=39533"},"human":"https://alion.io/catalog?offer=company.slices&for=job%2Foptimizely-senior-compliance-and-risk-analyst"},{"id":"market.stats","title":"A market slice: pay, demand and time to fill","status":"live","price":{"credits":1,"usd":0.1},"unit":"per slice","note":"pay, demand and time to fill for this role and place","call":{"mcp_tool":"market_stats"},"human":"https://alion.io/catalog?offer=market.stats&for=job%2Foptimizely-senior-compliance-and-risk-analyst"},{"id":"job.search","title":"Open jobs by role, technology, place, pay and visa","status":"live","price":{"credits":0.02,"usd":0.002},"unit":"per posting in a list","note":"similar open postings","call":{"mcp_tool":"search_jobs"},"human":"https://alion.io/catalog?offer=job.search&for=job%2Foptimizely-senior-compliance-and-risk-analyst"},{"id":"company.verify","title":"Is this company real and active right now","status":"pilot","price":null,"unit":"per company","request":{"url":"https://alion.io/catalog/request","method":"POST","body":"{\"offer\": \"company.verify\", \"for\": \"job/optimizely-senior-compliance-and-risk-analyst\", \"note\": \"what you need it for\"}"},"human":"https://alion.io/catalog?offer=company.verify&for=job%2Foptimizely-senior-compliance-and-risk-analyst"}]}