---
title: 'Junior Security Engineer, GRC at Hoxhunt'
canonical: 'https://feeny.ai/job/junior-security-engineer-grc-hoxhunt-helsinki-5k1kh29n956t'
type: 'job'
last_seen: '2026-09-07'
---

# Junior Security Engineer, GRC at Hoxhunt

- **Company:** Hoxhunt
- **Location:** Helsinki, Finland
- **Employment:** full-time
- **Work type:** hybrid
- **Posted:** 2026-09-02
- **Last confirmed live:** 2026-09-07
- **Apply:** https://jobs.ashbyhq.com/hoxhunt/a12aaff1-1696-44f0-a9ff-e2268f8584b2

## Job description

## OUR MISSION AND WHY IT MATTERS

We are on a mission to make humans the strongest security layer.

Human risk remains one of the biggest vulnerabilities and traditional awareness training is not enough. We take a different approach by combining AI-driven personalization, real threat detection, and behavioral science to actively protect people and organizations.

We don't just simulate risks. We build the tools that detect and stop them.

## WHY THIS ROLE MATTERS

We are looking for a Junior Security Engineer, GRC to join Hoxhunt's Product Security team. In this role, you will act as a quarterback to support customer trust by helping with the security questionnaires and RFPs that unblock sales deals, seeing each case through with guidance from senior teammates. You will also play a key role in our compliance footprint by helping collect and validate evidence across the frameworks we operate under (SOC 2 Type II, ISO 27001, ISO 42001, HIPAA), and you will learn to run the day-to-day coordination of our vulnerability management program and our recurring security activities. This is an excellent opportunity to build a career at the intersection of information security and business within a fast-growing SaaS company, with modern tooling and automation doing the heavy lifting. This is a growth role for someone with ambition. We hire juniors we expect to grow quickly, and we invest in making that happen by providing real ownership from week one and experienced mentors to support you.

## WHAT YOU'LL DO

- Quarterback RFP and security questionnaire responses: See each case you take through, end-to-end, with guidance from senior teammates. Triage the request, draft high-quality responses using our answer library and tooling, coordinate input from technical experts when needed, and drive it through to submission.
- Support continuous compliance: Help manage the evidence flow across SOC 2 Type II, ISO 27001, ISO 42001 and HIPAA. Validate evidence collected continuously through Vanta, handle manual needs, and work with engineers to automate processes to stay continuously audit-ready.
- Learn to run the vulnerability management coordination cadence: Review dashboards and automated triage output weekly, route findings to the code owners, track remediation against our CVSS-based SLAs, escalate when needed, and report on status.
- Coordinate our recurring security activities: Help manage the regular calendar including coordinating penetration testing with external partners, access and policy review cycles, and subprocessor reviews.
- Maintain our security knowledge base and sales collateral: Keep the answer library comprehensive, accurate, and current, and maintain external-facing security documentation that supports the sales process.
- Close the loop: Track security-questionnaire outcomes, collect lessons learned from each RFP cycle, and feed recurring gaps back to Product, Sales, and the security team.
- Support compliance reporting and external audits: Help prepare quarterly compliance status reporting for the Senior Management Team, keep procedures and policies documented, organize evidence for external audits, and help maintain our AI Management System.
- Contribute to security improvements: Research, propose, and deliver improvements to security controls, and collaborate on security automation initiatives with our engineers.

## WHAT SUCCESS LOOKS LIKE

- In your first 3 months you'll: Get up to speed with our existing security answer library and compliance tooling, start helping with incoming security questionnaires and RFPs, and begin learning the vulnerability management cadences and recurring security activities.
- By month 6 you'll: Smoothly support continuous compliance and evidence validation, actively partner with engineers to automate manual compliance tasks, confidently see RFPs through to submission with guidance from your team, and contribute to improvements in our security controls and knowledge base.

## WHAT MAKES YOU THRIVE HERE

You have:

- A genuine desire to work in compliance and with customers. This role is customer-facing security work at its core and requires someone who truly wants to do this work.
- Excellent written English with rigorous attention to detail to ensure every customer-facing answer is clear, accurate, professional, and error-free.
- Organizational and project-management ability to coordinate RFP execution by identifying the right internal stakeholders, gathering their input, and keeping everyone on deadline.
- An understanding of compliance frameworks (SOC 2, ISO 27001, ISO 42001, HIPAA, NIST) or a strong willingness to learn them quickly.
- An understanding of security controls and best practices, or the drive to build it fast.
- A self-motivated, continuous learning mindset where you actively teach yourself new frameworks, tools, and techniques.
- Currently pursuing or completed a Bachelor's or Master's degree in Information Security, IT, Business, or a related field.
- A mindset to use modern AI tools everywhere to expand and scale your reach, acting as a force multiplier.

You don't need to meet every qualification on day one. Three things are non-negotiable: you want to work in compliance and with customers, you use AI to accelerate everything you do, and you teach yourself what you don't know. If that's you, we'd like to hear from you even if the rest is still growing.

Bonus points if you also:

- Bring experience with GRC or RFP automation tools like Vanta, Drata, Loopio, or Hyperproof.
- Have previous experience in compliance, audit, security, or technical-writing roles.
- Possess basic programming or scripting skills (Python, Shell) for automation tasks.
- Have exposure to vulnerability management concepts like CVSS, triage, and remediation tracking.
- Understand AI-native, cloud-native, and SaaS business models.

## WHO YOU'LL WORK WITH

You will work daily with the Product Security team, whose shared job is to address any security concern a product team or customer raises. You will not start from scratch or work alone; the team behind you includes experienced colleagues who own the frameworks and engineers who build the automation you run. You will report to the Director of Product Security, collaborating closely with Sales, Product, and external partners in an environment where continuous learning and automation are the default.

## WHAT YOU CAN EXPECT FROM US

- Compensation: Monthly salary of €3,000 - €4,000 depending on your experience. You may notice varying salary ranges for roles with similar titles across Hoxhunt; this is because each range is grounded in our role leveling and reflects the seniority, scope, and impact expectations required for that specific role and team, and we operate with a low hierarchy.
- Working ways: We work in a flexible, but hybrid work setting. You are expected to visit the Helsinki office 2-3 days a week.
- High performance meets high humanity: We bring an incredibly driven, high-impact energy to our work, but we leave our egos at the door. You will be surrounded by wildly talented, dedicated colleagues in an environment built on extreme kindness, support, and psychological safety.
- Authentic trust & autonomy: We hire great people and trust them to do great work. You will find a culture free of micromanagement, giving you the autonomy to take real ownership, drive impact, and shape things early on.
- A product you can be proud of: It is incredibly rare in cybersecurity to build a product that end-users genuinely love. You will join a fast-paced, technically sophisticated team making a real, measurable impact against cybercrime.
- The perks that matter: Alongside this amazing community, you will enjoy extensive healthcare with other benefits and our beautiful office in Helsinki (complete with a gym and swimming pool!).

## RECRUITMENT PROCESS

We want to get to know you and how you think! Our process includes:

1. Screening call with Talent Acquisition (30 min, remote)
2. Interview with the Director of Product Security (45–60 min, remote)
3. Practical exercise and panel interview (60 min)
4. Meeting with the VP of Engineering (30 min)
5. Reference checks and final offer

## ABOUT HOXHUNT

Hoxhunt was founded in 2016 by four visionaries. Today we are a global team of +270 amazing Hoxhunters advancing a truly AI-native category leader in human risk management, with key hubs in the United States, the United Kingdom, Singapore, and Finland. We are proud to be an award-winning, fast-growing software company, recognized by G2 and Gartner, named to TIME Magazine's list of the World's Top EdTech Companies, and featured for our innovation in major publications like Fast Company, TechCrunch, Forbes, and Inc.

As a multi-product company, Hoxhunt goes beyond traditional security awareness. We don't just educate employees through frequent, personalized, and behavior-changing cybersecurity training - we also actively build real threat intelligence and response tools that protect organizations against malicious cyberattacks every single day.

Be among the first to know about our open positions. Drop your details in our Talent Community, and we will reach out when there is a match!

## About Hoxhunt

## Company Overview
- **One-liner**: Hoxhunt provides an AI-powered human risk management platform that transforms employees into a company’s strongest defense against cyber threats through personalized phishing simulations, security awareness training, and incident orchestration.
- **Entity Type**: Private (Raised $42.9M total; Series B in 2022)
- **Headquarters**: Helsinki, Finland (additional hubs in Minneapolis, USA and Singapore)
- **Founded**: 2016
- **Founders**: Mika Aalto (CEO), Pasi Salo, Karri Kurunmäki, Pyry Åvist (CTO)

## Core Business
- **Primary Industry**: Cybersecurity – Human Risk Management / Security Awareness Training
- **Target Customers**: B2B Enterprise (notable customers include DocuSign, Airbus, AES, Schindler, Nokia)
- **Mission**: “To protect individuals and organizations by focusing on the largest risks causing cyber breaches and incidents.” Their core belief: “Security Starts With People.”

## Products & Services
- **Human Risk Management Platform** – An AI-native, integrated suite that combines:
  - **Security Awareness & Phishing Training**: Automated, gamified micro-trainings delivered via email, Slack, or Teams.
  - **Phishing Simulations**: AI-generated, personalized simulations that mimic real-world attacks.
  - **Incident Orchestration (SOC Automation)**: AI-powered analysis and triage of user-reported phishing threats, reducing false-positive workload for security teams.
  - **Analytics & Dashboarding**: Measures behavior change, engagement rates, and risk reduction across the organization.

## Market Standing
- **Valuation**: Not disclosed
- **Key Metrics**: 
  - **Total Funding**: $42.9M (Series A $3M from Dawn Capital & Icebreaker in 2018; Series B $40M from Level Equity Management in 2022)
  - **Annual Revenue (FY 2024)**: €15.2M (per Craft.co)
  - **Users**: 4M+ globally (as of 2026)
  - **Monthly Activities**: 7M simulations, 500k analyzed threats
  - **Engagement Rate**: 90%+ | **Failure Reduction**: 75% lower failure rates | **Detect Rate**: 20%+
- **Notable Investors/Partners**: Level Equity Management, Dawn Capital, Icebreaker
- **Growth Signals**:
  - Deloitte Fast50: 4,284% growth over four years (2021)
  - Named G2 Enterprise Grid Leader (2025), Gartner Representative Provider for SBCP, Frost & Sullivan Competitive Strategy Leadership Award
  - 40+ internal promotions in one year
  - Headcount: 270+ employees (20+ nationalities) across three continents

## Competitive Advantages
- **Category Pioneer**: Co-created the Security Behavior Change and Human Risk Management category, moving beyond traditional SAT (Security Awareness Training).
- **High Engagement**: Gamified, personalized training achieves 90%+ engagement rates, far exceeding industry averages.
- **AI-Native Platform**: Automates simulation generation, threat analysis, and training delivery, reducing manual effort for security teams.
- **Enterprise Credibility**: Trusted by global brands like Airbus, Nokia, and DocuSign.

## Strategic Focus
- **Current Priorities**: Scaling the Human Risk Management platform, expanding into new geographies (notably APAC with a new Singapore hub), and deepening AI capabilities to stay ahead of evolving phishing tactics.
- **Growth Direction**: Continue to lead the security behavior change category, drive measurable risk reduction for large enterprises, and grow the user base (targeting millions more users).

## Why Work Here
- **Culture**: “High performance, without the sharp edges. High ambition, without the ego.” Emphasis on autonomy, trust, radical candor, and continuous learning.
- **Work Setup**: Hybrid/remote varies by role and location; most roles include regular weekly office time. Main hubs in Helsinki, Minneapolis, and a growing APAC hub in Singapore.
- **Office Perks (Helsinki)**: Office dogs, coffee bar, building gym & pool, sauna, and social activities (Padel, Dungeons & Dragons, Hoxfit).
- **Career Growth**: 40+ promotions in the last year; strong internal mobility and learning culture.
- **Hiring Process**: Typically includes an initial chat with Talent Acquisition, a meeting with the Hiring Manager, and a final panel interview (often on-site). Some roles include a take-home assignment. Process aims to be efficient and transparent.

## Sources
1. [hoxhunt.com/careers](https://hoxhunt.com/careers)
2. [hoxhunt.com/about](https://hoxhunt.com/about)
3. [hoxhunt.com/](https://hoxhunt.com/)
4. [craft.co/hoxhunt](https://craft.co/hoxhunt)
5. [topworkplaces.com/company/hoxhunt](https://topworkplaces.com/company/hoxhunt)

## Other roles at Hoxhunt

- [Account Executive, DACH (German-speaking)](https://feeny.ai/job/account-executive-dach-german-speaking-hoxhunt-helsinki-xa55pxeq6xks) — Helsinki, Finland
- [Senior Software Engineer, New product, Threat Detection, Full-stack](https://feeny.ai/job/senior-software-engineer-new-product-threat-detection-full-stack-hoxhunt-41sd52d3yfw5) — Helsinki, Finland
- [Senior Software Engineer, Gamified Phishing Training](https://feeny.ai/job/senior-software-engineer-gamified-phishing-training-hoxhunt-helsinki-0hmt07ky5enx) — Helsinki, Finland
- [Software Engineer, Security](https://feeny.ai/job/software-engineer-security-hoxhunt-helsinki-8apnxzjpgdfg) — Helsinki, Finland
- [Senior Software Engineer, Security](https://feeny.ai/job/senior-software-engineer-security-hoxhunt-helsinki-ydy0k6n2nr8m) — Helsinki, Finland
- [Customer Success Manager, Mid-Market](https://feeny.ai/job/customer-success-manager-mid-market-hoxhunt-minneapolis-3w9eha15f2fh) — Minneapolis, MN
- [Customer Success Manager, SMB](https://feeny.ai/job/customer-success-manager-smb-hoxhunt-minneapolis-psmz5qgknj3s) — Minneapolis, MN
- [Associate Customer Success Manager](https://feeny.ai/job/associate-customer-success-manager-hoxhunt-minneapolis-56fbeb8xqk6e) — Minneapolis, MN
- [Senior Product Designer](https://feeny.ai/job/senior-product-designer-hoxhunt-helsinki-7rc4j8b6n88f) — Helsinki, Finland
- [Senior Software Engineer, New product, Human Risk, Full-stack](https://feeny.ai/job/senior-software-engineer-new-product-human-risk-full-stack-hoxhunt-helsinki-zbwfg738zxyp) — Helsinki, Finland