Security Compliance Specialist
Confirmed on the employer's own hiring board on Nov 14, 2026. First seen by Alion on Nov 11, 2026. ReversingLabs scores B on the Alion truth index.
Please note: for this position, we are only considering candidates who are already based in Croatia.
At ReversingLabs, we provide the world’s largest threat intelligence repository to protect software development and power advanced security solutions, keeping leading cybersecurity organizations and Fortune 500 enterprises informed and ahead of threats. Only ReversingLabs delivers the software package analysis speed and depth needed to protect against software supply chain risk.
Our vision is clear: to arm every company with end-to-end insights so that development teams release securely, IT purchases safely, and the SOC can effectively detect, isolate, and respond. We are seeking extraordinary talent for this game-changing opportunity to help forge this transformational journey at ReversingLabs.
About the role
Our customers include US and European banks, insurers, government agencies and some of the largest technology and security companies. Before they buy or renew, their security teams want proof: full policies, evidence that controls work, and detailed answers to questionnaires that have grown far more demanding in the last three years.
You'll make sure we can give that proof quickly and accurately. You'll handle security questionnaires, our evidence library and our Trust Portal day to day, and work closely with the Director of Security Engineering & Compliance, who sets direction, reviews high-risk answers and leads customer calls. Your work directly decides how fast enterprise deals and renewals close.
What you'll do
Security questionnaires and customer reviews
- Handle security questionnaires from first draft to submission: SIG, CAIQ, custom bank, insurer and government questionnaires, and the new wave of AI/ML questionnaires
- Get input from Engineering, Research and Legal where needed, and bring high-risk answers to the Director for review
- Run large assessments and due-diligence reviews: write supporting documents such as system security plans, upload evidence to customer risk portals, and answer findings with remediation plans and dates
- Track follow-ups and annual re-reviews against the renewal calendar so Sales is never surprised
Trust Portal and Customer Assurance
- Trust Portal maintenance: Keep the Trust Portal current after every audit, pen test and policy change, maintain its library and handle document access requests
- Proactive content: Spot FAQs and add them to Trust Portal library
SOC 2 attestation support
- Build evidence library used for both SOC 2 and customers
- Collect SOC 2 evidence from control owners on schedule and support the Director through the annual audit
- Track audit findings and remediation items to closure, working with IT Support and Engineering
Policies and compliance support
- Keep the policy register and draft policy updates for the Director
- Run 3rd party vendor and sub-processor reviews
- Prepare compliance documents customers ask for under NIS2, GDPR and DORA
Security controls oversight
- Access management: Run periodic user access reviews and partner with IT Support to strengthen joiner, mover and leaver processes
- Logging and monitoring: Verify that logging and monitoring meet our policy and SOC 2 commitments, and work with Security Engineering to close gaps
- Encryption and data protection: Assess encryption at rest and in transit, key management practices and data retention against internal standards.
- BC/DR: Participate in planning and running disaster recovery tests and incident response tabletop exercises, and help turning the lessons learned into updated plans.
- Cloud security: Review cloud configurations against benchmarks and drive remediation of findings with Engineering.
What we're looking for
Must have
- 4+ years in information security, GRC, IT audit or security compliance
- Hands-on experience answering security questionnaires (SIG, CAIQ or custom) and/or preparing evidence for SOC 2 or ISO 27001 audits
- Solid understanding of security controls (access management, encryption, logging, BC/DR, secure development, cloud), enough to explain how a control works and what proves it
- Working knowledge of SOC 2, ISO 27001 and NIST CSF, and of GDPR and NIS2
- Excellent written English: clear, consistent answers, knowing they can become contract commitments
- Well organised: you run many requests with deadlines at once and follow up with people until you get what you need
- Comfortable working with US-based Sales teams and customers, with some overlap with US hours
Nice to have
- CISA, CISM, CRISC, CISSP, CompTIA Security+ or CIPP/E
- Experience with a GRC, Trust Center or questionnaire-automation platform
- Experience with AI/ML security questionnaires or AI governance frameworks (ISO/IEC 42001, NIST AI RMF)
- Background in a SaaS, security vendor or fintech company
Benefits
- Hybrid work options (paid accommodation & transportation to Zagreb during onboarding for remote employees)
- Flexible working hours
- Generous compensation and a bonus system based on annual performance
- Hefty personal education budget and possibility to attend leading conferences and seminars in the field
- Company library and possibility to order books of choice via Amazon
- Permanent contract in a fast-growing global company with Fortune 500 & governmental agencies as clients
- Challenging projects in a dynamic, collaborative team
- Great career advancement opportunities - clear goals & internal promotions
- Employee referral bonus program, EUR 1,060 net for junior position, EUR 2,123 net for mid to senior positions, and EUR 2,654 net for principal/managerial positions
- Multisport card, annual health checkup, newborn child allowance, rent-cost, and 3rd pillar pension benefits
- Wellness Weekends - quarterly, company-wide three day weekend, starting with a company paid Friday off for all employees
- Fully covered car garage in Radnička for all employees
About ReversingLabs
ReversingLabs is the leader in software supply chain security, helping the world's most security-conscious organizations detect and respond to threats hidden inside software. Our platform is trusted by Fortune 500 companies, government agencies, and security teams globally. We're a company that takes the work seriously and takes care of the people doing it.