Junior Security Engineer, GRC

Описание вакансии

OUR MISSION AND WHY IT MATTERS

We are on a mission to make humans the strongest security layer.

Human risk remains one of the biggest vulnerabilities and traditional awareness training is not enough. We take a different approach by combining AI-driven personalization, real threat detection, and behavioral science to actively protect people and organizations.

We don't just simulate risks. We build the tools that detect and stop them.

WHY THIS ROLE MATTERS

We are looking for a Junior Security Engineer, GRC to join Hoxhunt's Product Security team. In this role, you will act as a quarterback for customer trust by taking the lead on the security questionnaires and RFPs that unblock sales deals, owning each case end-to-end. You will play a key role in our compliance footprint by collecting and validating evidence across the frameworks we operate under (SOC 2 Type II, ISO 27001, ISO 42001, HIPAA). You will also run the day-to-day coordination of our vulnerability management program and our recurring security activities. This is an excellent opportunity to build a career at the intersection of information security and business within a fast-growing SaaS company, with modern tooling and automation doing the heavy lifting. This is a growth role for someone with ambition. We hire juniors we expect to grow quickly, providing real ownership from week one and experienced mentors to support you.

WHAT YOU'LL OWN AND DRIVE

\* Quarterback RFP and security questionnaire responses:

Triage requests, draft high-quality responses using our answer library and tooling (Vanta), coordinate input from technical experts, and drive it through to submission.

\* Drive continuous compliance:

Own the evidence flow across SOC 2 Type II, ISO 27001, ISO 42001 and HIPAA. Validate evidence collected through Vanta, handle manual needs, and work with engineers to automate processes to stay continuously audit-ready.

\* Run the vulnerability management coordination cadence:

Review dashboards and automated triage output weekly, route findings to the code owners, track remediation against CVSS-based SLAs, escalate when needed, and report on status.

\* Run our recurring security activities:

Own the regular calendar including coordinating penetration testing with external partners, quarterly access reviews, annual policy reviews and approvals, and annual subprocessor reviews.

\* Maintain our security knowledge base and sales collateral:

Keep the answer library comprehensive, accurate, and current, and maintain external-facing security documentation that supports the sales process.

\* Close the loop:

Track security-questionnaire outcomes, collect lessons learned from each RFP cycle, and feed recurring gaps back to Product, Sales, and the security team.

\* Support compliance reporting:

Help prepare quarterly compliance status reporting for the Senior Management Team and keep procedures and policies documented.

\* Assist in preparing for external audits, maintaining our AI Management System (AIMS, ISO 42001), and acting as a point of contact for external vulnerability reports. • Research, propose, and deliver improvements to security controls and contribute to security automation initiatives.

WHAT SUCCESS LOOKS LIKE

\* In your first 3 months you'll: Master our existing security answer library and compliance tooling, take ownership of incoming security questionnaires and RFPs, and begin coordinating vulnerability management cadences and recurring security activities.

\* By month 6 you'll: Smoothly drive continuous compliance and evidence validation, actively partner with engineers to automate manual compliance tasks, independently quarterback complex RFPs from triage to submission, and contribute to improvements in our security controls and knowledge base.

WHAT MAKES YOU THRIVE HERE

You have: