Security Compliance & Regulatory Affairs Analyst

Responsibilities

• Support the SCRA Lead in executing Twilio’s global security regulatory strategy, including contributing to program design, prioritization, and long-term regulatory planning.
• Independently interpret complex and ambiguous regulatory frameworks (e.g., NIS 2, EU transpositions, TSA UK) and provide structured outputs that support Lead-level strategy and decision-making.
• Support the development and maintenance of regulatory repositories and systems of record, ensuring accuracy, traceability, and audit readiness.
• Execute and continuously improve the Cyber Regulation Intake & Triage process in partnership with Legal, ensuring consistent classification, routing, and lifecycle tracking of regulatory obligations.
• Map regulatory requirements to internal control frameworks (e.g., UCF, ISO 27001, internal standards), identifying gaps and supporting Lead-driven control strategy decisions.
• Develop regulator-ready and high-quality artifacts, including evidence mappings, control narratives, risk statements, and audit support documentation.
• Identify, analyze, and escalate regulatory risks and audit obligations, supporting proactive planning and risk visibility at the program level.
• Partner cross-functionally with Legal, Public Policy, R&D, Security, Product, Sales, and Risk teams, supporting the Lead in aligning regulatory interpretation with technical and business implementation.
• Drive execution of process improvements, tooling enhancements, and automation initiatives defined by the SCRA program.
• Operate with high ownership and accountability, executing work independently while aligning to strategic direction set by the SCRA Lead.

Qualifications

Required

• 5+ years of experience in security compliance, telecom compliance, regulatory affairs, GRC, or related domain within a global technology, cloud, or telecom environment.
• Experience interpreting and operationalizing security frameworks and regulations (e.g., NIS 2, ISO 27001, SOC 2, telecom regulatory regimes).
• Experience mapping regulatory requirements to control frameworks, policies, and technical implementations.
• Broad understanding of security architecture, networking, access control, software development, cryptography, and operations.
• Ability to analyze ambiguous regulations / regulatory requirements and produce defensible interpretations to support leadership decision-making.
• Strong written communication skills with ability to produce audit-ready and regulator-defensible documentation.
• Proven ability to collaborate across Legal, Engineering, Security, Product, Sales, and Risk teams in support of program objectives.
• High level of self-sufficiency, critical thinking, and ownership, with ability to execute without detailed instruction.
• Demonstrated ability to independently execute and deliver complex workstreams end-to-end, while operating under high-level guidance.
• Ability to manage multiple concurrent priorities in a global, fast-evolving regulatory landscape.

Desired

• Deep understanding of hybrid cloud environments (AWS/GCP), on-premise infrastructure, APIs, and microservices architectures.
• Experience in the Telecommunications sector (e.g. telecommunications or CPaaS environments involving messaging, voice, network security).
• Familiarity with primary global regulatory regimes (EU, UK, APAC, LATAM).
• Experience working with regulatory repositories, intake/triage workflows, or compliance automation systems.
• Experience supporting external audits or regulator engagements.
• Exceptional organizational skills with the ability to context-switch effectively.
• Ability to distill granular technical findings into concise, high-level summaries that drive decision-making at the leadership level.