Information Security Compliance Specialist
- Hiring from
- Philippines
- Work type
- Hybrid
- Posted
614,747 remote jobs, straight from company career pages
100% free · New jobs every minute
Show job descriptionHide job description
We build legal drafting technology for moments that matter - when the stakes are high, the documents are complex, and speed can’t come at the cost of control.
Our platform helps legal teams move faster through contracts using automation, collaboration, and AI - without taking judgment away from the lawyers who own the risk. We believe technology should amplify expertise, not replace it.
Avvoka is trusted by leading law firms, banks, and global enterprises, and we’ve grown through product strength and word of mouth alone. With headcount and revenue increasing by over 70% year on year, we’re scaling from a product-led success into a globally recognised legal-tech brand.
We’re at an inflection point: evolving how the world’s most sophisticated legal teams work - and building a company where thoughtful people can do the best work of their careers.
Our platform helps legal teams move faster through contracts using automation, collaboration, and AI - without taking judgment away from the lawyers who own the risk. We believe technology should amplify expertise, not replace it.
Avvoka is trusted by leading law firms, banks, and global enterprises, and we’ve grown through product strength and word of mouth alone. With headcount and revenue increasing by over 70% year on year, we’re scaling from a product-led success into a globally recognised legal-tech brand.
We’re at an inflection point: evolving how the world’s most sophisticated legal teams work - and building a company where thoughtful people can do the best work of their careers.
You will keep Avvoka’s ISO 27001 certification healthy and help our clients trust us with their most sensitive documents. Avvoka’s customers are law firms and legal teams, so security assurance is part of every sale and every renewal.
This is a hands-on compliance role. You will help run the day-to-day of our Information Security Management System (ISMS), answer customer security due diligence questionnaires, assess the security of our suppliers, and manage our security documentation, with guidance from the Information Security Manager. You will work closely with Engineering, DevOps, Sales, Customer Success, Legal, and People Operations teams.
This is a hands-on compliance role. You will help run the day-to-day of our Information Security Management System (ISMS), answer customer security due diligence questionnaires, assess the security of our suppliers, and manage our security documentation, with guidance from the Information Security Manager. You will work closely with Engineering, DevOps, Sales, Customer Success, Legal, and People Operations teams.
Run the ISMS
• Help the team to maintain the ISMS day-to-day in line with ISO/IEC 27001, including the control evidence, and support SOC 2 Type II work where applicable.
• Support the internal audit programme and surveillance and recertification audits with the certification body.
• Maintain the information security risk register, facilitate risk assessments and follow up on treatment plans.
• Support security awareness training, track completion, and contribute to the company’s security awareness programme.
Answer customer security questionnaires
• Manage the response process for customer and prospect security questionnaires, with guidance from the Information Security Manager.
• Maintain an approved answer library so responses are fast, consistent, and accurate.
Assess supplier security
• Assist the team to run security due diligence on new suppliers and sub-processors before onboarding, scaled to the data and access they hold.
• Maintain the supplier inventory with risk tiers, owners, contract dates, and review cycles.
• Carry out periodic security reassessments of existing vendors.
• Track supplier remediation actions and keep the public sub-processor list current.
Manage security documentation
• Assist the team in maintaining the security documentation library, keeping documents version-controlled, approved, and reviewed at least annually.
• Draft and update policies, standards and procedures as the business, technology and regulations change.
• Map documentation to customer contractual commitments so gaps are visible.
• Help the team to maintain the ISMS day-to-day in line with ISO/IEC 27001, including the control evidence, and support SOC 2 Type II work where applicable.
• Support the internal audit programme and surveillance and recertification audits with the certification body.
• Maintain the information security risk register, facilitate risk assessments and follow up on treatment plans.
• Support security awareness training, track completion, and contribute to the company’s security awareness programme.
Answer customer security questionnaires
• Manage the response process for customer and prospect security questionnaires, with guidance from the Information Security Manager.
• Maintain an approved answer library so responses are fast, consistent, and accurate.
Assess supplier security
• Assist the team to run security due diligence on new suppliers and sub-processors before onboarding, scaled to the data and access they hold.
• Maintain the supplier inventory with risk tiers, owners, contract dates, and review cycles.
• Carry out periodic security reassessments of existing vendors.
• Track supplier remediation actions and keep the public sub-processor list current.
Manage security documentation
• Assist the team in maintaining the security documentation library, keeping documents version-controlled, approved, and reviewed at least annually.
• Draft and update policies, standards and procedures as the business, technology and regulations change.
• Map documentation to customer contractual commitments so gaps are visible.
The ideal candidate would have:
• 2-3 years in information security compliance, GRC, IT audit or a similar role.
• Experience completing customer security questionnaires for a SaaS or technology business.
• Experience assessing third-party or supplier security risk.
• Enough technical understanding of cloud hosting, access control, encryption, AI integrations, and secure development to discuss them credibly with engineers and customers.
• Clear, precise writing; able to turn technical controls into plain answers and policies.
Bonus points if you have:
• Certifications such as CISA or ISO 27001 Lead Implementer.
• Experience with SOC 2 Type II or Cyber Essentials Plus.
• An understanding of secure AI governance.
Equal opportunities
We are an equal opportunity employer that celebrates diversity and inclusion. We welcome applications from individuals of all backgrounds, identities, and experiences - including those from underrepresented groups - and are happy to provide reasonable adjustments for candidates with disabilities during the recruitment process.
• 2-3 years in information security compliance, GRC, IT audit or a similar role.
• Experience completing customer security questionnaires for a SaaS or technology business.
• Experience assessing third-party or supplier security risk.
• Enough technical understanding of cloud hosting, access control, encryption, AI integrations, and secure development to discuss them credibly with engineers and customers.
• Clear, precise writing; able to turn technical controls into plain answers and policies.
Bonus points if you have:
• Certifications such as CISA or ISO 27001 Lead Implementer.
• Experience with SOC 2 Type II or Cyber Essentials Plus.
• An understanding of secure AI governance.
Equal opportunities
We are an equal opportunity employer that celebrates diversity and inclusion. We welcome applications from individuals of all backgrounds, identities, and experiences - including those from underrepresented groups - and are happy to provide reasonable adjustments for candidates with disabilities during the recruitment process.
