Staff Security Analyst - GRC

The role

A Staff Security Analyst will advise, build, and operate security and compliance programs at scale. You will lead efforts to acquire and maintain commercial compliance certifications and assist with Federal initiatives.

What you will do

• Design, implement, and continuously monitor commercial compliance controls.
• Develop and implement automation solutions to scale compliance tasks.
• Contribute to Federal compliance initiatives and frameworks.
• Support customer trust initiatives by reviewing contracts and completing security questionnaires.
• Provide guidance to ensure security and privacy by design for engineering, product, and business initiatives.
• Manage relationships and facilitate engagement with external suppliers, auditors, assessors, and enterprise prospects.
• Identify, track, and mitigate risks related to compliance projects and supply chain security.
• Articulate security capabilities and controls to enterprise customers and regulatory auditors.

Required qualifications

• Minimum of 8-10 years of relevant industry experience in security, compliance, and GRC program management.
• Extensive exposure to commercial industry regulations, frameworks, and compliance certifications (ISO 27001, SOC 1, SOC 2, PCI-DSS, HIPAA).
• Previous experience with GRC tools.
• Demonstrated ability to build automation for security and compliance controls in a cloud-native environment (AWS, GCP, or Azure).
• Working knowledge or exposure to Federal compliance frameworks (e.g., NIST 800-53, FedRAMP, CMMC).
• Strong cybersecurity acumen.
• Solid technical proficiency with enterprise SaaS applications and infrastructure.
• Excellent project management and organizational skills.
• Clear, concise communication skills, both written and verbal.

Nice to have

• Hands-on experience building, delivering, or managing a FedRAMP-compliant service offering (FedRAMP Moderate+) or achieving an ATO.
• Familiarity with specialized defense/federal environments like Platform One, Iron Bank, CMMC, or DoD IL.
• Familiarity with the AWS or GCP console and best practices for configuration and management.
• Relevant security or technical certifications (ISO 27001 Lead Implementer/Auditor, PCI QSA, CISA, CISSP, PMP, AWS/GCP Professional, or FedRAMP-specific credentials).
• Previous experience assessing and utilizing AI in a secure environment.
• Exposure to or experience with Kubernetes, SBOMs, SLSA, and/or DLP.
• Eagerness to share knowledge with junior colleagues.

Benefits

• Competitive salary
• Comprehensive healthcare benefits
• Flexible Spending Account (FSA)
• Flexible work schedule
• Employee Assistance Program (EAP)
• Flexible Time Off and Parental Leave
• Monthly, quarterly, and annual social and team building events
• Monthly internet reimbursement

About the company

Harness is the AI Software Delivery Platform company. It brings AI and automation to the software delivery lifecycle to help teams ship software faster while maintaining security and governance.