• Run our security compliance program day to day: own the audit calendar, keep the control framework current, manage the security and compliance risks and prepare the materials that feed executive-level reporting and governance forums.
• Coordinate internal and external audits (SOC 1, SOC 2 Type II, ISO 27001:2022 and customer-driven assessments), including evidence collection, auditor logistics, and tracking of findings through to remediation with control owners.
• Operate the corporate risk management program: maintain the risk register, facilitate periodic risk assessments with control owners, prepare quarterly risk reporting (NIST CSF 2.0 based), and surface cross-departmental risks for treatment decisions.
• Maintain the ISMS policy and standards library: author and revise core policies, coordinate scheduled reviews with control owners, and keep them current against regulatory obligations (GDPR, NIS2/ZoKB, EU AI Act, CRA) and customer-driven frameworks (GxP, DORA, FFIEC, NERC CIP, PCI DSS).
• Review security terms in customer contracts, security schedules and addenda with enterprise and regulated-industry customers, together with Legal.
• Manage the RFx and customer security questionnaire process: operate the workflow against established quality standards, direct the specialists and interns answering questionnaires, and act as senior reviewer for high-stakes prospect and customer submissions.
• Assess and onboard new compliance standards and regulations: control mappings, gap analyses and remediation plans in coordination with Engineering, Cloud Operations and IT. Support customer assurance commitments for regulated customers, including GxP validation lifecycle artifacts and Quality and Security Agreements.
• Build and maintain internal GRC so the team scales its output without adding headcount.
• Provide input into incident response and vendor risk management: vendor due diligence, incident playbooks and cost analysis, and customer notifications.
• Manage a small team of compliance specialists and interns, including work supervision, task allocation, quality review, mentoring and hiring.
• Help drive security awareness and training initiatives, including secure use of AI tools across the company.
• Liaise with stakeholders across Cloud and App Security, Engineering, Legal, Sales and Customer Success on compliance-impacting topics, translating between the audit, technical and business worlds for non-specialist audiences.

Is This You?

• 3+ years of experience in information security, GRC, IT audit or compliance
• Able to grasp both business and technical concepts, and distill what matters.
• Hands-on with standards and frameworks such as ISO 27001, SOC 2 and NIST CSF, and with at least one customer-driven framework (GxP, DORA, FFIEC, NERC CIP or PCI DSS).
• Capable of reading and interpreting legal and regulatory texts, with working knowledge of data privacy and cybersecurity regulation (GDPR, NIS2/ZoKB, EU AI Act, CRA).
• A builder: when a compliance task comes back for the third time, you script it, automate it or build a scalable workflow, and you use AI tools responsibly and can set guardrails for others.
• Technically fluent enough to talk to engineers about how a cloud SaaS platform is built and operated (AWS and Azure, Kubernetes, CI/CD, vulnerabilities, identity and access) and about common security threats.
• A strong communicator, comfortable writing policies and documentation, giving presentations, and briefing executives, auditors and customers.
• Proactive, positive, and self-organized: you don't wait to be told what to do, and you are comfortable owning a whole agenda in a small team with few formalities.
• Experience supervising or mentoring specialists or interns, including hiring.
• Strong written and verbal English communication skills; Czech is a plus for ZoKB and local partners.
• Relevant certifications (e.g., ISO 27001 Lead Auditor or Lead Implementer, CISA, CRISC, CISSP, CIPP/E) are a plus.
• People management skills and experience are welcome.

• Long-Term Incentive Program
• 2 sick days and 25 days of vacation, with the option to request additional Flexible Time-Off days when needed
• The Global Family Support Program - a paid leave program to help all parents focus on the new addition to their family
• Flexible working hours & hybrid work setup
• Benefit Plus - flexible employee benefit platform (incl. Multisport card)
• Annual package for mental health support
• "Bring Your Friend" referral program
• Shared company cards for free entrance to Prague Zoo & Botanical garden
• Company bikes, longboards, e-scooters
• Conference tickets to the best industry events of the year
• Online courses & company access to Udemy to hone your skills
• Access to paid AI tools
• Company library, where you can even suggest the best educational books for us to order
• Kitchens stocked with fresh fruit and juice, teas, and the best coffee

Work Equipment

• Company laptop
• Company mobile phone + SIM card & package of mobile data

At Ataccama , our core values are Candid & Caring , so we are upfront about our process and details that are important to you. We sometimes use AI tools to help us with things like reviewing applications, taking notes from screening conversations, scheduling interviews, or supporting assessments. These tools make the process smoother and fairer — but don’t worry, they never make the final decision. Every hiring decision is made by our Talent Acquisition Partners and Hiring Managers, with AI only acting as a helpful assistant. We believe technology should support the process, not replace the human touch.

We currently use AI-assisted tools - Metaview for interview notes and Lever Talent Fit to help highlight key experience. If you have any questions or concerns, feel free to reach out to us at , making reference to AI Act Inquiry in the subject line.

While we highly value cooperation with all our business partners, we don’t accept unsolicited resumes from any sources other than directly from a candidate. We reserve the right not to pay any fee for sending an unsolicited offer containing the details or resume of a job candidate, even if the relevant candidate is employed by our company.