Security Compliance Specialist – GRC (Cloud & Container Security)

About the role

We are looking for a Security Compliance Specialist with strong GRC expertise to drive security and compliance initiatives across cloud and container environments. You will work closely with architects, engineers, and business stakeholders to translate requirements into actionable solutions.

Key responsibilities

• Gather and analyse functional and non‑functional requirements by collaborating with architects, cloud and container engineers, capability leads, and control owners.
• Define and prioritise epics within agile sprints, providing clear goals, acceptance criteria and dependencies for engineering execution.
• Maintain traceability between business requirements, technical specifications and delivered features together with CNAPP, cloud services and cyber engineering teams.
• Advise stakeholders new to CNAPP on requirement elicitation and solution design.
• Conduct workshops and demos, obtain design sign‑off and validate implementations.
• Define acceptance criteria and ensure they are met.
• Map integrations and APIs between CNAPP components and HSBC systems such as downstream reporting and data‑lake pipelines.

Required profile

• 5+ years of experience as a Business Analyst in cybersecurity or security‑compliance platforms (SaaS or on‑premise).
• Proven experience working in Agile/Scrum environments, writing epics, features and user stories.
• Excellent stakeholder management, facilitation and communication skills in English.
• Ability to work in a fast‑paced environment, manage competing priorities and meet aggressive delivery timelines.

Required skills

• Hands‑on knowledge of CNAPP, APSM, CSPM and vulnerability‑scanning tools.
• Experience with configuration baseline, compliance and inventory management.
• API integration, micro‑services architecture and container orchestration (Kubernetes, AWS, GCP).
• DevOps processes and cloud platforms (AWS, GCP).
• Familiarity with regulatory frameworks such as PCI‑DSS and CIS Benchmarks.