Information Security Governance Specialist

Trust is what enables the world's leading brands to build on Frontify. Behind that trust is our Security Governance team, ensuring our security is not only effective, but also measurable, demonstrable, and easy for customers and auditors to verify. Our work spans compliance, regulatory oversight, customer security assurance, vendor risk management, security policy management, awareness, and enterprise risk management. A key focus of the role is driving the next stage of our security governance maturity. Today, too many governance activities still rely on collecting evidence, chasing screenshots, and preparing spreadsheets for audits. You'll help transform that by introducing automation and AI into our governance processes, enabling continuous evidence collection, automated control monitoring, and more efficient audit readiness. This creates more space for the team to focus on the areas where human expertise, critical thinking, and sound judgment create the greatest value.

Responsibilities

Own customer security assurance, ensuring enterprise security questionnaires, due diligence requests, and audit inquiries are handled accurately, consistently, and efficiently; Drive the day-to-day operation and continuous improvement of compliance programs, including ISO 27001, SOC 2, TISAX, and emerging regulatory requirements; Serve as the subject matter expert during audits and ensure the control environment remains effective and audit-ready; Help transform compliance from a point-in-time activity into a continuous process by introducing automation and AI into the Vanta-based GRC program; Design and improve AI-enabled GRC workflows, leveraging LLMs to streamline policy management, documentation, risk assessments, and other governance activities; Strengthen the vendor risk management program by scaling security assessments through automation while ensuring higher-risk vendors receive appropriate human review; Contribute to the continuous improvement of the security awareness program

Requirements

Comfortable working in a hybrid format, with the ability to come to the St. Gallen office once per week; 5+ years of experience in information security governance, GRC, or technology risk within a SaaS or cloud environment; Subject matter expert in SOC 2 and/or ISO 27001 audits, working directly on controls and partnering with auditors; Hands-on with modern GRC platforms (Vanta and Conveyor), reaching for automation over manual effort; Entrepreneurial thinker who embraces new technologies and challenges the status quo; Genuinely excited about applying AI to compliance work, understanding where it accelerates and where human judgment matters; Communicates risk clearly to technical and business audiences; Fluent in English

Nice to have

TISAX; Microsoft SSPA; CISA; CISM; CISSP; CIPP; German

Benefits

Minimum of 25 days annual leave per year; Parental, family care, and bereavement leave; Daily sickness benefits and accident insurance; Paid educational and wellbeing days off; Wellbeing, learning and development, and commuter allowance; Home office setup budget; Pension fund contributions paid 60% by the company and 40% by the employee; Access to exclusive perks and discounts from top brands; Workation up to 45 days per year; Summer company meet-up