Please note: for this position, we are only considering candidates who are already based in Croatia.
At ReversingLabs, we provide the world’s largest threat intelligence repository to protect software development and power advanced security solutions, keeping leading cybersecurity organizations and Fortune 500 enterprises informed and ahead of threats. Only ReversingLabs delivers the software package analysis speed and depth needed to protect against software supply chain risk.
Our vision is clear: to arm every company with end-to-end insights so that development teams release securely, IT purchases safely, and the SOC can effectively detect, isolate, and respond. We are seeking extraordinary talent for this game-changing opportunity to help forge this transformational journey at ReversingLabs.
About the role
Our customers include US and European banks, insurers, government agencies and some of the largest technology and security companies. Before they buy or renew, their security teams want proof: full policies, evidence that controls work, and detailed answers to questionnaires that have grown far more demanding in the last three years.
You'll make sure we can give that proof quickly and accurately. You'll handle security questionnaires, our evidence library and our Trust Portal day to day, and work closely with the Director of Security Engineering & Compliance, who sets direction, reviews high-risk answers and leads customer calls. Your work directly decides how fast enterprise deals and renewals close.
What you'll do
Security questionnaires and customer reviews
Handle security questionnaires from first draft to submission: SIG, CAIQ, custom bank, insurer and government questionnaires, and the new wave of AI/ML questionnaires
Get input from Engineering, Research and Legal where needed, and bring high-risk answers to the Director for review
Run large assessments and due-diligence reviews: write supporting documents such as system security plans, upload evidence to customer risk portals, and answer findings with remediation plans and dates
Track follow-ups and annual re-reviews against the renewal calendar so Sales is never surprised
Trust Portal and Customer Assurance
Trust Portal maintenance: Keep the Trust Portal current after every audit, pen test and policy change, maintain its library and handle document access requests
Proactive content: Spot FAQs and add them to Trust Portal library
SOC 2 attestation support
Build evidence library used for both SOC 2 and customers
Collect SOC 2 evidence from control owners on schedule and support the Director through the annual audit
Track audit findings and remediation items to closure, working with IT Support and Engineering
Policies and compliance support
Keep the policy register and draft policy updates for the Director
Run 3rd party vendor and sub-processor reviews
Prepare compliance documents customers ask for under NIS2, GDPR and DORA
Security controls oversight
Access management: Run periodic user access reviews and partner with IT Support to strengthen joiner, mover and leaver processes
Logging and monitoring: Verify that logging and monitoring meet our policy and SOC 2 commitments, and work with Security Engineering to close gaps
Encryption and data protection: Assess encryption at rest and in transit, key management practices and data retention against internal standards.
BC/DR: Participate in planning and running disaster recovery tests and incident response tabletop exercises, and help turning the lessons learned into updated plans.
Cloud security: Review cloud configurations against benchmarks and drive remediation of findings with Engineering.
What we're looking for
Must have
4+ years in information security, GRC, IT audit or security compliance
Hands-on experience answering security questionnaires (SIG, CAIQ or custom) and/or preparing evidence for SOC 2 or ISO 27001 audits
Solid understanding of security controls (access management, encryption, logging, BC/DR, secure…