Junior Security Engineer, GRC

About the role

Hoxhunt is looking for a Junior Security Engineer, GRC to join its Product Security team. You will act as the quarterback for security questionnaires, RFPs and vulnerability management, ensuring continuous compliance across SOC 2, ISO 27001, ISO 42001 and HIPAA.

Key responsibilities

• Draft and coordinate high‑quality responses to security questionnaires and RFPs using tools such as Vanta.
• Own evidence collection and validation for SOC 2, ISO 27001, ISO 42001 and HIPAA, automating processes where possible.
• Run the weekly vulnerability management cadence, route findings, track remediation against CVSS‑based SLAs and report status.
• Coordinate recurring security activities including penetration testing, access reviews, policy reviews and sub‑processor assessments.
• Maintain the security answer library, external‑facing documentation and sales collateral.
• Support compliance reporting, audit preparation and act as a point of contact for external vulnerability reports.

Required profile

• A genuine desire to work in compliance and interact directly with customers.
• Excellent written English with meticulous attention to detail.
• Strong organizational and project‑management abilities to lead RFP execution.
• Willingness to learn or existing knowledge of SOC 2, ISO 27001, ISO 42001, HIPAA and NIST frameworks.
• Self‑motivated, continuous‑learning mindset and a degree in Information Security, IT, Business or related field.
• Comfort using AI tools to accelerate work.

Required skills

• Experience with GRC/RFP automation tools such as Vanta, Drata, Loopio or Hyperproof.
• Basic programming or scripting skills (Python, Shell).
• Understanding of vulnerability management concepts, including CVSS scoring.

What we offer

• Monthly salary of €3,000 – €4,000, based on experience.
• Hybrid work model with 2‑3 days per week in the Helsinki office.
• Comprehensive healthcare benefits and access to a gym and swimming pool on site.
• Opportunities for rapid growth, mentorship and ownership from day one.