---
title: 'Information Security Analyst II (GRC) at Checkout.com'
canonical: 'https://feeny.ai/job/information-security-analyst-ii-grc-checkout-com-london-294dce1fp0cc'
type: 'job'
last_seen: '2026-09-07'
---

# Information Security Analyst II (GRC) at Checkout.com

- **Company:** [Checkout.com](https://feeny.ai/companies/checkout-com)
- **Location:** London, United Kingdom
- **Employment:** full-time
- **Work type:** onsite
- **Posted:** 2026-06-22
- **Last confirmed live:** 2026-09-07
- **Apply:** https://jobs.ashbyhq.com/checkout.com/2a3630d8-7462-442a-8c05-75f595b240c4/application

**Skills:** PCI DSS v4.0.1, ISO 27001, SOC 2, DORA, NIST CSF, EU AI Act, Risk management, Third-party risk management, Merchant due diligence, AWS, Azure, GCP, GRC tooling, Risk platforms, Compliance automation, ISO 42001, NIST AI RMF

> Own and manage GRC workstreams including PCI DSS, ISO 27001, and SOC 2. Coordinate audit evidence, conduct risk assessments, and support compliance activities for global entities. Act as a liaison for external auditors and mentor junior analysts.

## Job description

Company Description

We’re http://checkout.comCheckout.com http://Checkout.com. You might not know our name, but companies like eBay, Spotify, Klarna, Uber, and Sony do, because we’re behind many of the digital experiences you use every day.

We are where the world checks out, enabling over 10 billion transactions yearly for more than one billion global shoppers.

Whether you want to book a holiday, order food, renew a subscription, or check out online, there’s a good chance our tech powers the payments behind the scenes. Our platform helps the most ambitious businesses deliver effortless digital experiences, at scale.

If you want to do career-defining work, you’ve come to the right place. We move fast, think globally, and believe great teams are built by hiring exceptional people with conviction, curiosity, and the desire to make an impact.

With 20 offices across six continents and London as our HQ, we’re shaping the future of fintech – and we’re just getting started.

## THE ROLE

As an Information Security Analyst II within the GRC team, you will take meaningful ownership of Checkout.com http://Checkout.com's governance, risk and compliance programmes. This is a role for someone who has moved beyond task execution and is ready to drive workstreams, lead compliance activities, and act as a trusted point of contact for internal teams and external assessors.

You will work across Checkout's core compliance frameworks including PCI DSS v4.0.1, ISO 27001, SOC 2, and emerging regulatory obligations such as DORA and the EU AI Act, supporting our global footprint across Europe, MENA, APAC, and the Americas. You will coordinate audit evidence activities, conduct risk assessments, improve GRC processes, and support the development of junior colleagues.

This role sits at the heart of how Checkout manages risk. We don't just audit and report. We own the risk narrative, drive the control environment, and ensure the business can grow with confidence in regulated markets worldwide.

## How You'll Make an Impact

## GOVERNANCE, RISK AND COMPLIANCE PROGRAMME MANAGEMENT

- Own and manage defined workstreams within Checkout's GRC programme, including PCI DSS v4.0.1, ISO 27001, SOC 2, and relevant regulatory obligations across our global licensed entities.
- Coordinate control evidence collection activities across internal teams, ensuring continuous audit readiness rather than point-in-time preparation.
- Maintain and improve GRC documentation including policies, standards, procedures, and control matrices, ensuring they stay current and proportionate to Checkout's evolving risk profile.
- Perform gap analyses against new or evolving requirements including DORA and the EU AI Act, translating findings into prioritised remediation plans.
- Support monitoring of the risk register, track remediation activity against agreed timelines, and escalate issues where commitments are at risk.
- Conduct third-party risk assessments, evaluating supplier security controls and compliance posture in line with Checkout's TPRM framework.

## AUDIT AND ASSESSMENT SUPPORT

- Act as a key liaison between internal teams and external auditors, QSAs, and assessors across PCI DSS, ISO 27001, IT General Controls (ITGCs) and SOC 2 certification cycles.
- Prepare and deliver evidence packages, coordinate walkthroughs, and manage audit findings through to closure.
- Support end-to-end response process for merchant assurance questionnaires and due diligence inquiries, ensuring all technical and regulatory queries are addressed with accuracy and within agreed SLAs.
- Support quarterly and annual compliance activities including vulnerability scanning, penetration testing coordination, access reviews, and firewall configuration reviews.

## POLICY, CONTROLS AND REGULATORY COVERAGE

- Apply working knowledge of PCI DSS v4.0.1, ISO 27001/27002, SOC 2, DORA, NIST CSF, and other applicable frameworks to day-to-day GRC work.
- Support meeting regulatory change across Checkout's operating markets including FCA/PRA requirements and payment scheme obligations, flagging gaps and supporting impact assessments.
- Proactively identify inefficiencies in GRC processes and propose practical improvements, including automation where viable.
- Contribute to the development and refinement of GRC tooling, dashboards, and reporting to improve visibility of risk and compliance posture across the business.

## STAKEHOLDER ENGAGEMENT AND MENTORING

- Work closely with Engineering, Product, Legal, Procurement, and Finance to embed security and compliance requirements into processes, systems, and projects.
- Respond to PCI DSS, ISO 27001, and broader security-related due diligence requests from merchants, partners, and regulators.
- Provide guidance and day-to-day support to junior analysts (L1 and L2), contributing to their development through knowledge sharing and review.
- Promote a security-first culture across Checkout through proactive engagement, awareness sessions, and accessible guidance for non-security teams.

## WHAT WE'RE LOOKING FOR

## EXPERIENCE

- 2 to 4 years of experience in GRC, information security compliance, IT audit, or a closely related function, ideally within payments, financial services, or fintech.
- Practical working knowledge of PCI DSS (v4.0.1 preferred), ISO 27001, and SOC 2. Familiarity with DORA, NIST CSF, or the EU AI Act is a plus.
- Experience supporting or directly managing external audits and assessments, including evidence collation and assessor liaison.
- Demonstrated ability to own a programme workstream independently, from planning through to delivery.
- Well-versed in risk management processes include risk identification, third-party risk management and merchant due diligence.

## SKILLS AND APPROACH

- Clear written and verbal communication. You can translate a compliance requirement or risk finding for a technical team and a business stakeholder with equal clarity.
- Analytical and process-oriented mindset. You look for root causes, not just point-in-time fixes.
- Comfortable operating with ambiguity. You can prioritise and structure your work without every requirement being fully defined upfront.
- Methodical and well-organised, with strong attention to detail and a consistent track record of delivering on commitments.
- Collaborative and pragmatic. You understand that security and compliance must work with the business, not against it.

## PREFERRED

- CISA, CISM, PCIP, ISO 27001 Lead Implementer or Auditor, or equivalent certification.
- Familiarity with cloud environments (AWS, Azure, GCP) in a GRC or compliance context.
- Experience with GRC tooling, risk platforms, or compliance automation.
- Exposure to AI governance frameworks such as ISO 42001, EU AI Act, or NIST AI RMF.

## HYBRID WORKING MODEL

All of our offices globally are onsite three times per week (Tuesday, Wednesday, and Thursday). We've worked towards enabling teams to work collaboratively in the same space while also being able to partner with colleagues globally. During your days at the office, we offer great snacks, breakfast, and lunch options in all of our locations.

Additional Information

Bring all of you to work

We create the conditions for high performers to thrive, through real ownership, fewer blockers, and work that makes a difference from day one.

Here, you’ll move fast, take on meaningful challenges, and be recognized for the impact you deliver. It’s a place where ambition gets met with opportunity, and where your growth is in your hands.

We work as one team, and we back each other to succeed. So whatever your background or identity, if you’re ready to grow and make a difference, you’ll be right at home here.

It’s important we set you up for success and make our process as accessible as possible. So let us know in your application, or tell your recruiter directly, if you need anything to make your experience or working environment more comfortable.

Life at Checkout.com http://Checkout.com

We understand that work is just one part of your life. Our hybrid working model offers flexibility, with three days per week in the office to support collaboration and connection.

Curious about what it’s like to be part of our team? Visit our Careers Page https://www.checkout.com/careers to learn more about our culture, open roles, and what drives us.

For a closer look at daily life at Checkout.com http://Checkout.com, follow us on LinkedIn https://www.linkedin.com/company/checkout/life/ and Instagram https://www.instagram.com/checkout_com/

## About Checkout.com

## Company Overview
- **One-liner**: Checkout.com is a global, high-performance payment platform that enables enterprises to accept payments, move money, and optimize revenue through a modular, AI-powered suite of services.
- **Entity Type**: Private (Series D, last funding round Jan 2022)
- **Headquarters**: London, England, United Kingdom
- **Founded**: 2012
- **Founders**: Guillaume Pousaz

## Core Business
- **Primary industry**: Payments / FinTech (online payment processing, acquiring, fraud management, money movement)
- **Target customers**: B2B – primarily enterprise merchants and high-growth digital businesses (e.g., e-commerce, travel, food delivery, marketplaces)
- **Mission or purpose**: To turn payments into a powerful revenue driver for businesses by obsessing over every basis point of performance.

## Products & Services
- **Connect**: Accept payments online via a single API, supporting 150+ currencies and local acquiring in 50+ countries.
- **Move**: Simplify global money movement, including payouts, refunds, and supplier payments (e.g., via Visa Direct).
- **Boost** (Intelligent Acceptance): AI-powered engine that optimizes payment routing and retries to increase conversion rates.
- **Protect**: Fraud detection, authentication, identity verification, and chargeback management tools.
- **Manage**: Centralized dashboard for monitoring payments, balances, and analytics across all geographies.

## Market Standing
- **Valuation/Market Cap**: Not disclosed (private company; last Series D raised $1B at a reported valuation of $40B in Jan 2022 per news, but this is not confirmed in search results – treat as unconfirmed)
- **Key Metric**: Processed $300B in total ecommerce payment volume in 2025 for enterprise merchants (source: checkout.com homepage); total funding raised: $1.8B (Crunchbase)
- **Notable Investors/Partners**: Franklin Templeton, Ribbit Capital (among 14 investors per Crunchbase); partner with Visa Direct; named a Leader in The Forrester Wave™: Merchant Payment Providers, Q1 2026
- **Growth Signals**: 19 offices worldwide; 1,000–5,000 employees; serves category-defining businesses (e.g., Klarna, Grab, The Trade Desk, etc. as shown in case studies); AI-powered Intelligent Acceptance delivering 4–6% uplift in acceptance rates for clients.

## Competitive Advantages
- **Proprietary technology**: Cloud-native, self-healing infrastructure with high uptime and local acquiring in 50+ countries.
- **AI-first optimization**: Intelligent Acceptance engine uses network data and machine learning to maximize conversions.
- **Modular platform**: Products work standalone or together, allowing merchants to customize their payment stack.
- **Enterprise scale**: Proven ability to handle billions in volume for global merchants.
- **Single platform for issuing and acquiring**: Recently unified issuing and acquiring to improve liquidity and control for travel and other verticals.

## Strategic Focus
- **AI acceleration**: Going all-in on AI across products and internal operations (see blog “How we’re using AI to accelerate our velocity”).
- **Agentic commerce**: Preparing for AI-driven shopping agents by developing merchant-controlled checkout models and chargeback strategies.
- **Expanding money movement**: Enhancing payout capabilities (e.g., Visa Direct partnership) and virtual card issuing.
- **Global reach**: Continuing to add local acquiring markets and payment methods.

## Why Work Here
- **Culture**: High-performance, ownership-driven environment with values like “Athlete Mindset”, “Never Give Up”, “Talk Straight”, and “One Team”. Emphasis on continuous improvement, data-driven decisions, and speed.
- **Hybrid policy**: Required in-office Tuesday, Wednesday, Thursday (as of Aug 2025). Also offers “Work from Anywhere” options and flexibility.
- **Diversity & belonging**: Nine employee-led communities (Ability+, Arab, Asian, Black, Jewish, Latine, Parents, Pride, Women). Committed to inclusive hiring and accessibility.
- **Benefits**: Comprehensive health and wellbeing cover, family-forming support, high-quality food in offices, volunteering days, sustainable pace with time away, and choice/control over rewards.
- **Growth**: Fast-paced environment with early ownership, global opportunities, and a focus on learning (continuous development resources).
- **Hiring process**: Four stages – recruiter screen, first interview, task/challenge, final interview. Typically 4–6 weeks. Feedback provided after each stage.

## Sources
1. [checkout.com](https://www.checkout.com/?ref_type=adv)
2. [checkout.com/life-at-checkout](http://www.checkout.com/life-at-checkout)
3. [checkout.com/jobs](https://www.checkout.com/jobs)
4. [checkout.com/careers](https://www.checkout.com/careers)
5. [crunchbase.com](https://www.crunchbase.com/organization/checkout-com)

## Other roles at Checkout.com

- [Specialist, Deal Management](https://feeny.ai/job/specialist-deal-management-checkout-com-london-5p97jv2ts35a) — London, United Kingdom
- [Senior Software Engineer](https://feeny.ai/job/senior-software-engineer-checkout-com-shanghai-barnj3ynp55w) — Shanghai, China
- [Senior Product Designer](https://feeny.ai/job/senior-product-designer-checkout-com-london-5fgfsnv3t964) — London, United Kingdom
- [Senior Software Engineer I](https://feeny.ai/job/senior-software-engineer-i-checkout-com-paris-wr0kt0e3b4hv) — Paris, France
- [Senior Data Analyst, People Analytics](https://feeny.ai/job/senior-data-analyst-people-analytics-checkout-com-london-714nm12wg69j) — London, United Kingdom
- [Senior Engineer I, Payments Engineering](https://feeny.ai/job/senior-engineer-i-payments-engineering-checkout-com-tallinn-7jjj5079vhm8) — Tallinn, Estonia
- [Risk Monitoring Analyst](https://feeny.ai/job/risk-monitoring-analyst-checkout-com-home-based-wfqqqx94sj5k) — Home-Based, Mexico
- [Project Manager - Integrations](https://feeny.ai/job/project-manager-integrations-checkout-com-paris-84xf2n607d8x) — Paris, France
- [Principal, CEO Office](https://feeny.ai/job/principal-ceo-office-checkout-com-london-bqbadmpsrf6h) — London, United Kingdom
- [Senior Manager, External Affairs - UAE](https://feeny.ai/job/senior-manager-external-affairs-uae-checkout-com-dubai-xrny5xcngdvw) — Dubai, United Arab Emirates