Note: The job is a remote job and is open to candidates in USA. Harness is an AI Software Delivery Platform company that provides AI and automation across the software delivery lifecycle with embedded security, governance, and compliance controls. The Staff Security Analyst will lead commercial security and compliance programs, support federal compliance initiatives, build GRC automation, advise cross-functional teams, and manage customer trust, risk, and auditor relationships.
Responsibilities
- Commercial Compliance Management: Design, implement, and continuously monitor commercial compliance controls, collaborating with engineering teams to ensure environments are properly scoped and secured for SOC 1, SOC 2, ISO 27001, PCI-DSS, and HIPAA
- GRC Engineering & Automation: Develop and implement automation solutions to scale compliance tasks, automate control testing, integrate continuous compliance checks into the CI/CD pipeline, and streamline reporting
- Federal Compliance Support: Contribute to Federal compliance initiatives and frameworks (such as FedRAMP Moderate+, CMMC, DoD IL, and FedRAMP 20x) as Harness expands its public sector footprint
- Customer Trust & Advisory: Support customer trust initiatives by reviewing contracts for security and privacy requirements, completing detailed customer security questionnaires, and maintaining the customer trust portal
- Cross-Functional Collaboration: Contribute precise and actionable guidance to ensure security and privacy by design for engineering, product, and business initiatives
- Stakeholder Engagement: Manage relationships and facilitate engagement with external suppliers, auditors, assessors, and enterprise prospects
- Risk Management: Identify, track, and mitigate risks related to compliance projects, continuously monitor supply chain security, and manage vendor risk
- Evangelism: Articulate Harness's security capabilities and controls clearly to enterprise customers and regulatory auditors
Skills
- You have a minimum of 8-10 years of relevant industry experience in security, compliance, and GRC program management
- Extensive exposure to commercial industry regulations, frameworks, and compliance certifications (ISO 27001, SOC 1, SOC 2, PCI-DSS, HIPAA)
- Previous experience with GRC tools and a demonstrated ability to build automation for security and compliance controls in a cloud-native environment (AWS, GCP, or Azure)
- Working knowledge or exposure to Federal compliance frameworks (e.g., NIST 800-53, FedRAMP, CMMC) and are interested in expanding these programs
- You possess strong cybersecurity acumen and solid technical proficiency with enterprise SaaS applications and infrastructure
- Excellent project management and organizational skills, with the ability to handle multiple priorities and build new programs from scratch
- Clear, concise communication skills, both written and verbal, and can effectively partner with technical engineering teams as well as non-technical stakeholders
- You are comfortable navigating ambiguity and driving clarity in complex, fast-paced situations
- Remote within the U.S or Hybrid from one of our offices
- You have hands-on experience building, delivering, or managing a FedRAMP-compliant service offering (FedRAMP Moderate+) or achieving an ATO
- Familiarity with specialized defense/federal environments like Platform One, Iron Bank, CMMC, or DoD IL
- You are familiar with what is going on under the hood of the AWS or GCP console and can speak to best practices for configuration and management
- You hold relevant security or technical certifications (ISO 27001 Lead Implementer/Auditor, PCI QSA, CISA, CISSP, PMP, AWS/GCP Professional, or FedRAMP-specific credentials)
- Previous experience assessing and utilizing AI in a secure environment
- You have exposure to or experience with Kubernetes, SBOMs, SLSA, and/or DLP
- You like to "automate the boring stuff" and are eager to share your knowledge with junior colleagues
Benefits
- Comprehensive healthcare benefits
- Flexible Spending Account (FSA)
- Flexible work schedule
- Employee Assistance Program (EAP)
- Flexible Time Off and Parental Leave
- Monthly, quarterly, and annual social and team building events
- Monthly internet reimbursement
- Remote within the U.S or Hybrid from one of our offices
- The compensation package for this position may also include equity
Company Overview
Company H1B Sponsorship