Information Security Governance Specialist

You'll own customer security assurance, ensuring enterprise security questionnaires, due diligence requests, and audit inquiries are handled accurately, consistently, and efficiently, helping customers make informed decisions while supporting commercial success.

You'll drive the day-to-day operation and continuous improvement of our compliance programs, including ISO 27001, SOC 2, TISAX, and emerging regulatory requirements.

You'll serve as the subject matter expert during audits and ensure our control environment remains effective and audit-ready.

You'll help transform compliance from a point-in-time activity into a continuous process by introducing automation and AI into our Vanta-based GRC program. This includes improving evidence collection, control monitoring, and access review processes.

You'll design and improve AI-enabled GRC workflows, leveraging LLMs to streamline policy management, documentation, risk assessments, and other governance activities while ensuring appropriate governance and human oversight.

You'll strengthen Frontify's vendor risk management program by scaling security assessments through automation while ensuring higher-risk vendors receive appropriate human review.

You'll contribute to the continuous improvement of Frontify's security awareness program by helping employees build practical security knowledge rather than simply completing mandatory training.

You’re comfortable working in a hybrid format, with the ability to come to our St. Gallen office once per week.

You have 5+ years of experience in information security governance, GRC, or technology risk within a SaaS or cloud environment.

You've been the subject matter expert in SOC 2 and/or ISO 27001 audits — not just supporting them, but working directly on controls and partnering with auditors. Experience with additional frameworks such as TISAX or Microsoft SSPA is a plus.

You're hands-on with modern GRC platforms (we run Vanta and Conveyor), and you instinctively reach for automation over manual effort.

You're genuinely excited about applying AI to compliance work, and you can tell the difference between where it accelerates you and where human judgment still matters.

You communicate risk clearly to both technical and business audiences, and you enjoy helping those around you do their best work.

A relevant certification (CISA, CISM, CISSP, CIPP, or similar) is a plus.

You speak English fluently. German is a plus.