Senior GRC Analyst

About HelloFresh

At HelloFresh, our mission is simple: to change the way people eat, forever.

As a global digital-native FMCG company and the world’s leading meal kit provider, HelloFresh is transforming the traditional food supply chain through a data-driven, on-demand model that enables scalable and more sustainable food delivery.

The HelloFresh Group includes eight brands serving customers across multiple meal occasions, including HelloFresh, Green Chef, EveryPlate, Chefs Plate, Factor, YouFoodz, Good Chop, and The Pets Table. Through technology, data, and culinary innovation, we deliver personalized food experiences to millions of households worldwide.

The Role

We are looking for a new team member to support the implementation and ongoing maintenance of information security compliance and certification programs. In this role, you will work closely with cross-functional internal teams and external auditing agencies while also supporting data protection, data privacy, and third-party vendor risk management initiatives.

You will join the Governance, Risk & Compliance (GRC) team, which is responsible for:

• Creating, maintaining, and improving HelloFresh’s security risk management program.
• Managing remediation activities.
• Developing information security and data privacy processes, policies, and guidelines.
• Supporting compliance and certification activities.
• Driving security awareness and education across the organization.

We value diverse backgrounds and experiences. Even if you don’t meet every qualification, we’d love to hear from you if you believe you’d thrive in this role.

What You’ll Do

• Lead end-to-end compliance readiness for NIS2 and support alignment with frameworks such as PCI DSS, CSRD, ISO/SOC, and the EU AI Act.
• Plan and execute internal control assessments.
• Coordinate external compliance audits on a scheduled basis.
• Translate regulatory requirements into practical security controls.
• Drive cross-functional implementation across international teams.
• Own remediation management, including tracking findings, evidence, owners, deadlines, and reporting progress to stakeholders.
• Improve GRC maturity through continuous monitoring, documentation, and mentoring junior team members.
• Evaluate the design and operational effectiveness of security policies, standards, and internal controls.
• Develop reports and presentations on the compliance landscape for both technical and executive audiences.

What You’ll Bring

• 3+ years of experience performing compliance activities related to:
  • IT General Controls (ITGC)
  • SOC 2
  • ISO 27001
  • PCI DSS
  • EU NIS2
  • Data privacy regulations (GDPR, CCPA/CPRA, etc.)
• Ability to interpret compliance regulations and map them to real-world system implementations while referencing security frameworks.
• Experience supporting data privacy compliance and third-party risk management programs.
• Experience developing and delivering security awareness programs and training.
• Excellent organizational skills with strong attention to detail and the ability to work independently.
• Industry certifications such as CISA, CISM, or CISSP are a plus.
• Experience working in a SaaS environment, particularly with Cloud and AWS technologies.

What We Offer

• Join one of Europe’s fastest-growing technology companies during an exciting period of growth.
• Work in a diverse global community representing more than 90 nationalities.
• Competitive compensation package.
• HelloFresh-subsidized pension scheme.
• Berlin relocation support.
• Hybrid working model.
• Exclusive discounts on HelloFresh meal boxes and office meals.
• German language learning budget.
• Access to the HelloFresh Academy for professional development.
• Mental health and wellbeing support, including Headspace and Spill.
• Transportation benefits.
• Working-parent-friendly benefits.
• 24/7 gym access.
• Sabbatical leave options.