Senior Security Analyst

This is a fully remote position, open to applicants in United States.

📋 Description

• Enhance OpenSesame’s security framework as a Senior Security Analyst within the Compliance team.

• Oversee vulnerability management, penetration testing, bug bounty initiatives, cloud security, application security, and audit preparedness.

• Collaborate with Engineering, DevOps, IT, and Compliance to refine security processes and bolster compliance initiatives.

• Create a holistic understanding of the external attack surface, vulnerabilities, and the threat landscape.

• Manage external penetration testing efforts, including vendor selection, scope design, execution oversight, remediation validation, and reporting to executives.

• Develop and implement a structured vulnerability management program.

• Establish workflows for evidence collection and control mapping in Drata.

• Design and put into action continuous penetration testing programs.

• Enhance the quality of bug bounty signals, triage, researcher engagement, and remediation processes.

• Spearhead the integration of AI security protocols across internal systems and product development.

• Utilize OWASP Top 10 for LLMs / AI systems to identify and address emerging risks.

• Assist in the adoption and implementation of ISO 42001 controls.

• Define secure usage patterns for internal AI tools and third-party AI integrations.

• Establish and enforce secure AI and application baseline standards with Product Engineering.

• Develop security automation and tools using Python, APIs, and Make.

• Continuously gather threat intelligence, verify security baselines, and detect drift across AWS, GCP, GitHub, and SaaS platforms.

• Enhance Jira and Confluence workflows for managing security findings and remediation.

• Offer technical support during audits in accordance with ISO 27001, ISO 27701, and ISO 42001.

• Assist with vendor evaluations, customer security questionnaires, and control design.

• Advance secure development practices, CI/CD security controls, and cloud security standards.

• Establish governance models for AI security.

• Identify systemic risks, recurring vulnerability trends, and process inefficiencies.

• Contribute to the long-term security strategy.

⛳️ Requirements

• Demonstrated experience in managing penetration testing programs.

• Proven track record of building vulnerability management systems.

• Experience in implementing security automation solutions.

• Background in assisting organizations to securely and responsibly adopt modern technologies, including AI.

• Ability to create a comprehensive view of the external attack surface, vulnerabilities, and threat landscape.

• Familiarity with CrowdStrike, AWS, GCP, and application security tools.

• Experience in managing external penetration testing engagements from start to finish.

• Experience in developing and operationalizing vulnerability management programs.

• Knowledge of Drata for evidence collection and control mapping workflows.

• Experience with continuous penetration testing, automation, and threat modeling.

• Proven experience in managing and enhancing bug bounty programs.

• Familiarity with OWASP Top 10 for LLMs / AI systems.

• Knowledge of ISO 42001 controls.

• Ability to define secure usage patterns for internal AI tools and third-party AI integrations.

• Proficiency in Python, APIs, and Make.

• Experience working with AWS, GCP, GitHub, and SaaS platforms.

• Familiarity with Jira and Confluence workflows.

• Knowledge of ISO 27001, ISO 27701, and ISO 42001.

• Experience with secure development practices, CI/CD security controls, and cloud security standards.

• Capability to establish governance models for AI security.

• This position can be located anywhere in the US.

• Willingness to travel up to 15 days per year; senior management and leadership teams may travel up to 35 days.

🏝️ Benefits

• Professional development opportunities.

• Incentive stock options.

• Health insurance coverage.

• 401(k) matching.

• Paid time off.

• Comprehensive medical, dental, and vision insurance.

• Flexible PTO policy.

• Volunteer time off.

• Employee Resource Groups.

• Generous professional development program with dedicated time off for learning and growth.

• Hands-on AI training with clear guidelines for responsible experimentation.

• Remote-first work arrangement.

• Mandatory company-wide meetings several times a year.

• Required team travel as needed.