Security & Compliance Specialist

AppTweak is ISO 27001 certified, and our customers increasingly expect clear, reliable answers on how we protect their data. Maintaining this level of trust is no longer a side activity: it requires dedicated ownership, rigour, and continuity throughout the year, not only in the weeks before an audit. Today, compliance work and customer security questions are spread across the engineering team. ISO controls, policy updates and audit preparation compete with delivery priorities, and Deal Desk often has to escalate RFPs and security questionnaires to engineers for questions that are not development questions at all. The Security & Compliance Specialist brings these two topics under one owner. Internally, they keep our ISMS alive and audit-ready: checks are done on time, policies are up to date, and evidence is available when needed. Externally, they become the go-to expert for Deal Desk on SLAs, data retention, backups, GDPR and related questions, so that customers get fast, consistent and accurate answers, and engineers can stay focused on building. This is a part-time position (50%). It reports directly to the Head of Engineering, and works in close collaboration with Legal, notably on GDPR, data processing agreements and the contractual commitments we make to customers. What You Will Do ISO 27001 & ISMS Ownership - Own the day-to-day running of our Information Security Management System (ISMS) and make sure it reflects how AppTweak actually works. - Follow up on the ISO control plan: make sure recurring checks are performed by the right owners, on time, and that evidence is properly documented. - Maintain the risk register, the Statement of Applicability, and track corrective actions and non-conformities until they are closed. - Support the classification and follow-up of our suppliers, in line with our supplier tiering approach. Policies & Documentation - Maintain and regularly review our security and compliance policies (access control, backups, data retention, incident management, business continuity, etc.). - Make sure policies are clear, accessible and known by the teams they apply to, not only written for the auditor. - Keep a single, reliable source of truth for compliance documentation that other teams can easily consult. Audit Preparation & Support - Prepare internal and external audits: plan the timeline, gather evidence, and coordinate with the people involved. - Be the main point of contact for auditors during the audit, and follow up on findings afterwards. - Turn audit outcomes into concrete improvement actions, and make sure they are delivered. Deal Desk & Customer Trust - Act as the first line of support for Deal Desk on non-development technical questions: SLAs, data retention, backup policies, GDPR, hosting, access management and security practices. - Help answer RFPs and security questionnaires, and only escalate to engineering the specific points that genuinely require it. - Build and maintain a reusable knowledge base of approved answers, so Deal Desk can become more autonomous over time. - Ensure what we commit to customers is consistent with our policies and what we actually do. Cross-Team Collaboration - Work closely with Engineering Managers, DevEx/infrastructure, HR, Legal and Deal Desk to embed compliance into existing processes rather than adding friction. - Raise awareness of security and compliance topics across the company, and help onboard new joiners on the essentials. Continuous Improvement & Strategic Projects - Be proactive: challenge how things are done today and propose improvements to our security, compliance and Deal Desk processes, rather than only running them as they are. - Drive strategic compliance projects end to end, such as building and maintaining our CAIQ (Consensus Assessments Initiative Questionnaire) so customer security assessments can be answered faster and more consistently.