Assist in current and planned audits like ISO 27001, SOC 2, PCI DSS, HIPAA, and related assurance tasks by organizing evidence gathering, evaluating evidence standards, arranging walkthrough sessions, and communicating with control owners.
Aid in risk evaluations, maintaining the risk register, overseeing controls, monitoring issues, and ensuring risk mitigation by collaborating with teams to spot control deficiencies, establish actionable steps, and supervise corrective measures until resolved.
Perform assessments of third-party risks to contribute to a holistic understanding of organizational risk exposure.
Assist with continuous compliance efforts across existing frameworks and new readiness initiatives (such as Australia ISM/IRAP/HCF, NIS2, and ISO 42001/AIM) while managing policies, procedures, control descriptions, and supplementary records.
Address security and compliance queries from customers and prospects in coordination with Sales, Legal, Security, and Product departments, and help update the Trust Center and related trust materials.
Create concise reports on audit progress, risks, obstacles, metrics, and correction advancements for leadership, and seek ways to streamline repetitive tasks and lessen audit burdens for control owners.
Utilize risk, audit, and compliance software to maintain organization, traceability, and reporting efficiency.
Provide support for internal audit and review operations as required.

Minimum of five years in risk management, auditing, compliance, governance, security assurance, or a closely aligned field.
Practical involvement in aiding audits, gathering evidence, testing or monitoring controls, and tracking remediation efforts.
Functional understanding of security and compliance standards such as ISO 27001, SOC 2, PCI DSS, HIPAA, ISO 42001, GDPR, PIPEDA, or comparable frameworks.
Capability to articulate requirements effectively to both technical and non-technical groups.
Excellent organizational and prioritization abilities, particularly when handling multiple deadlines simultaneously.
Sound judgment, meticulous attention to detail, and a pragmatic problem-solving approach.
Ease working in a remote, international setting with cross-functional teams across different time zones.

Familiarity with governance, risk, and compliance software or audit management systems.
Background in supporting customer assurance, security questionnaires, or trust documentation.
Working knowledge of third-party risk management (TPRM) processes.
Hold relevant certifications like CISA, CRISC, CISSP, CC, CISM, CGEIT, ISO 27001, ISO 42001, or similar credentials.

Remote (Worldwide) — Canada, Spain, Germany, France, United Kingdom

Background checks are mandatory for all positions.
Work remotely with a global team.
Flexible paid time off policy.
Extensive healthcare coverage available in the UK, Canada, France, Spain, and USA.
Eligibility for company stock options.
Budget allocated for professional development.
Allowance for office equipment.
Wellness budget provided.
Yearly team meetups organized.
Reimbursement for internet expenses.
Inclusive parental leave policy.
Program for remote work travel support.

Upsun (formerly Platform.sh) is hiring a Senior Risk & Audit Specialist