Staff Security Analyst – GRC

This is a fully remote position, open to applicants in United States.

📋 Description

• Provide advice, construct, and manage security and compliance programs at scale within the GRC team and Information Security organization.

• Oversee security initiatives to obtain and uphold commercial compliance certifications while supporting Federal projects.

• Create solutions that align with Harness security objectives and collaborate with business and engineering teams.

• Develop, implement, and consistently monitor compliance controls for SOC 1, SOC 2, ISO 27001, PCI-DSS, and HIPAA.

• Establish automation to enhance compliance processes, automate control testing, incorporate continuous compliance checks into CI/CD pipelines, and simplify reporting.

• Contribute to Federal compliance projects related to FedRAMP Moderate+, CMMC, DoD IL, and FedRAMP 20x.

• Analyze customer contracts for security and privacy obligations.

• Complete security questionnaires for customers and manage the customer trust portal.

• Offer guidance on security and privacy by design across engineering, product, and business projects.

• Cultivate relationships with suppliers, auditors, assessors, and enterprise prospects.

• Identify, monitor, and mitigate risks associated with compliance projects.

• Oversee supply chain security and manage vendor risks.

• Articulate Harness security capabilities and controls to enterprise customers and regulatory auditors.

⛳️ Requirements

• A minimum of 8–10 years of pertinent industry experience in security, compliance, and GRC program management.

• Significant familiarity with commercial industry regulations, frameworks, and compliance certifications, including ISO 27001, SOC 1, SOC 2, PCI-DSS, and HIPAA.

• Experience utilizing GRC tools.

• Capability to develop automation for security and compliance controls in a cloud-native setting using AWS, GCP, or Azure.

• Working knowledge or exposure to Federal compliance frameworks such as NIST 800-53, FedRAMP, and CMMC.

• Strong understanding of cybersecurity principles.

• Technical skills related to enterprise SaaS applications and infrastructure.

• Proficient project management and organizational abilities.

• Excellent written and verbal communication skills.

• Ability to collaborate with technical engineering teams and non-technical stakeholders.

• Practical experience in building, delivering, or managing a FedRAMP-compliant service offering or achieving an ATO is advantageous.

• Familiarity with Platform One, Iron Bank, CMMC, or DoD IL is a plus.

• Relevant security or technical certifications such as ISO 27001 Lead Implementer/Auditor, PCI QSA, CISA, CISSP, PMP, AWS/GCP Professional, or FedRAMP-specific credentials are advantageous.

• Experience in assessing and utilizing AI in a secure environment is beneficial.

• Exposure to Kubernetes, SBOMs, SLSA, and/or DLP is a plus.

🏝️ Benefits

• Competitive salary.

• Comprehensive healthcare benefits.

• Flexible Spending Account (FSA).

• Flexible work schedule.

• Employee Assistance Program (EAP).

• Flexible Time Off and Parental Leave.

• Monthly, quarterly, and annual social and team-building events.

• Monthly internet reimbursement.

• Equity may be included in the compensation package.