Security & Compliance Analyst

Catapult is building the future of sports performance technology, with a mission to Unleash the Potential of every athlete and team on earth. We don't just work in the sporting industry; we are actively changing it. Since 2006, our solutions have been leading the way in sports performance software, science, and data, in a world where 1% can literally mean the difference between winning and losing.

We work with over 5,000+ teams around the world, empowering coaches, managers and trainers in premier teams in the NFL, NBA, NHL, MLS, EPL, AFL, NRL, NCAA and more. We provide the information they need to optimize athletes’ health, game-day readiness, and performance, as well as in-game tactics.

Catapult is a sports technology company that empowers professional teams to make data-driven decisions. We deliver health, performance, video, and AI insights from the locker room to competitive environments, ensuring every decision is an opportunity to gain an advantage, sharpen performance, and build lasting success.

We are seeking a talented and inquisitive Security & Compliance Analyst whose drive for excellence and continuous improvement aligns with our mission to transform the future of elite performance. In this role, you will be a strategic architect of our trust framework, responsible for maturing a security and compliance program that safeguards our enterprise operations and our next-generation cloud platform. You will play a pivotal role in protecting a complex ecosystem that integrates high-value digital video assets, real-time wearable data, and sensitive athlete biometrics.

• Orchestrate Program Maturity:
  Drive the continuous evolution of the Catapult Sports security and compliance framework, leveraging the ISO 27001 standard to strengthen our global posture across risk management and vendor security work streams.
• Lead Assessment & Remediation:
  Facilitate internal audits and partner with third-party assessors to proactively identify compliance gaps, transforming findings into actionable, high-priority remediation plans.
• Modernize Governance & Policy:
  Collaborate with key stakeholders to architect and maintain robust policies and procedures, ensuring our control environment remains resilient and compliant with ISO 27001, GDPR, and HIPAA requirements.
• Strengthen Ecosystem Trust:
  Partner with cross-functional teams to mature our Third-Party Risk Management (TPRM) program, ensuring that our vendor landscape meets the same rigorous security standards we apply to our own products.
• Enable Global Growth:
  Support our commercial and partnership teams by responding to sophisticated security questionnaires, demonstrating Catapult’s commitment to data integrity and building trust with our most elite customers.

• BA/BS degree and 3+ Years in Cyber GRC:
  Proven experience in a Security Analyst, Compliance, or Audit role within a fast-paced SaaS or Cloud-native environment.
• Deep expertise in ISO 27001 is essential, including demonstrated success in managing an Information Security Management System (ISMS) and leading the full audit lifecycle. This requires a thorough knowledge of mapping technical security controls directly to the ISO 27001 standard.
• Third-Party Risk Proficiency:
  Experience in managing vendor security programs, including the ability to analyze SOC 2 reports and security questionnaires to identify and mitigate supply chain risks.
• Familiarity with cloud security concepts and standards.
• Collaborative Problem Solving:
  The ability to act as a bridge-builder between technical teams (Tech Ops/Engineering) and business stakeholders, translating complex compliance requirements into clear, actionable tasks.

• Operational Rhythm:
  You have seamlessly integrated into our ISO 27001 cycle, ensuring our newly achieved certification is supported by a consistent, documented rhythm of internal audits and control evidence collection.
• Cross-Functional Trust:
  You are recognized by the Tech Ops and Engineering teams as a collaborative partner who provides clear, actionable compliance guidance rather than just…