Oct 31, 2025 · Global
ISO/IEC 27001:2013 certificates have expiredThe three-year transition to ISO/IEC 27001:2022 ended on 31 October 2025. Certification is now against the 2022 edition and its reorganized Annex A of 93 controls.
Source: ISO ↗Real roles. Honest matches. Audit-ready teams.
ApplyDesk is where GRC, security and AI-governance professionals find verified work, and where companies find verified practitioners to get audit-ready without Big 4 prices.
Try it: 3 SOC 2 questions
Is MFA enforced for staff on production systems?
Do you review user access on a schedule, with evidence?
Do you have a tested incident response plan?
Answer all three to see a teaser score.
Every listing shows its trust score
A real listing right now: Senior Manager, Security Risk Management at Affirm
High · 85/100
- +20Opened and checked by the ApplyDesk job scan
- +15Seen live by the scan in the last week
- -5No pay posted
- +5Work arrangement is stated
Members can report a bad posting, and every report lowers its score for everyone.
How it works
For practitioners
- Set your rules. Roles, pay floor, arrangement, and the skills and credentials you hold.
- Get verified matches. Each listing shows its trust score and exactly why you do or don't fit.
- Apply honestly. Tailored notes from your own profile; auto-apply only where it's allowed.
For companies
- Take the free check. SOC 2, ISO 27001 or AI governance, in about 3 minutes.
- See your gaps. A score by area and next steps, clearest gaps first.
- Get matched. With practitioners whose credentials a reviewer has verified.
Roles we cover
AI / ML Engineering
AI engineers, ML engineers, applied scientists and LLM builders.
0 open roles
Cybersecurity Engineering
Security, cloud security, identity, AppSec and detection engineers.
4 open roles
AI Governance, Risk & Compliance
AI governance, GRC, third-party risk, privacy and audit leaders.
15 open roles
How ApplyDesk compares
| ApplyDesk | Typical job boards | Mass auto-apply tools | |
|---|---|---|---|
| Postings checked before they're shown | Yes | Not usually | No |
| Must-haves you lack are flagged, not hidden | Yes | Rarely | No |
| Applies without breaking sites' rules | Yes | n/a | Often automates sites that forbid it |
| Verified credential badges | Yes | Self-reported | No |
| Readiness help for companies | Yes | No | No |
Stay ahead
All updates →Framework updates
Feb 26, 2024 · Global
NIST CSF 2.0 puts governance firstCSF 2.0 added Govern as a sixth function, alongside Identify, Protect, Detect, Respond and Recover, covering cyber risk strategy, roles and supply-chain risk. NIST continues to publish quick-start guides and mappings for it.
Source: NIST ↗Regulatory landscape
Jul 27, 2026 · EU
EU AI Act: high-risk deadlines pushed backThe Digital Omnibus on AI, in force since 27 July 2026, moves Annex III high-risk obligations (uses such as hiring, credit and education) from 2 August 2026 to 2 December 2027, and Annex I (AI inside regulated products) to 2 August 2028. Transparency and general-purpose AI obligations keep their original dates.
Source: Orrick ↗Jun 2026 · Canada
Canada's Bill C-8 becomes lawThe Critical Cyber Systems Protection Act received Royal Assent in June 2026. Its core duties, including a cybersecurity program for designated operators in critical sectors, begin once an order brings the Act into force and operators are designated.
Source: Public Safety Canada ↗Grow your career
Most requested in today's 21 open roles:
IAPP, effort: medium. No experience requirement: it's exam-based.
ISC2, effort: large. 5 years of paid security work in at least 2 of the 8 CISSP domains (a degree can count for 1 year). Without it you can pass the exam and become an Associate of ISC2.
ISACA, effort: large. 5 years in IS/IT audit, control, assurance or security; some education and experience can substitute for part of it.
Top skills asked for: GRC, IAM, Entra ID, PAM, ServiceNow.
Why we built it
ApplyDesk started as a GRC consultant's own job search. It kept hitting the same problems: postings tagged remote that required five days in the office, expired listings still being served, and contract rates displayed at a third of their real value. Mass-apply tools made it worse, spamming employers and risking candidates' accounts.
So we built the tool we needed: check every posting, be honest about fit, and never send anything in your name that you didn't allow. By 28 Views.
Questions
Will auto-apply get my LinkedIn or Indeed account banned?
No. ApplyDesk only sends applications on its own platform, to employers who accept them. For LinkedIn, Indeed and other sites it prepares a tailored application and you submit it yourself, because their terms prohibit automation.
What does "verified" mean?
For listings: our scan opened and checked the posting before listing it. For credentials: a reviewer checked the member's evidence against the issuer's own record. Neither is automatic guesswork.
Who can see my information?
Profiles and photos are visible to signed-in members only. Your auto-apply rules, pay floors and notes are private to you.
Is the readiness check an audit?
No. It's a free self-assessment that shows your likely gaps and next steps. It isn't an audit, certification or attestation, and ApplyDesk isn't affiliated with the AICPA or ISO.
What does it cost?
Everything is free during the beta. Proposed prices are on the plans page, and "Notify me" tells us what you'd pay for.
Get the updates that matter
Framework changes, regulatory deadlines and incident lessons for GRC and security teams. No spam.