Staff Security Analyst - GRC

A Staff Security Analyst will be a critical member of the GRC team working within the Information Security organization and across the business to advise, build, and operate security and compliance programs at scale. Utilizing in-depth expertise across multiple disciplines, you will be responsible for executing various components of Harness' security posture and overseeing end-to-end solutions to complex compliance problems.

As a Staff Security Analyst, you will lead security efforts to acquire and maintain crucial compliance certifications across Commercial sectors while assisting with Federal initiatives. You will design solutions that enable Harness' security goals and collaborate directly with business and engineering teams to preserve velocity while ensuring top-tier security. This role requires a strong core in Commercial Compliance mastery (SOC 2, SOC 1, ISO 27k, HIPAA, PCI), Customer Trust experience, and hands-on GRC Engineering and Automation capabilities, complemented by familiarity with Federal Compliance (FedRAMP, NIST 800-53).

Commercial Compliance Management: Design, implement, and continuously monitor commercial compliance controls, collaborating with engineering teams to ensure environments are properly scoped and secured for SOC 1, SOC 2, ISO 27001, PCI-DSS, and HIPAA.

GRC Engineering & Automation: Develop and implement automation solutions to scale compliance tasks, automate control testing, integrate continuous compliance checks into the CI/CD pipeline, and streamline reporting.

Federal Compliance Support: Contribute to Federal compliance initiatives and frameworks (such as FedRAMP Moderate+, CMMC, DoD IL, and FedRAMP 20x) as Harness expands its public sector footprint.

Customer Trust & Advisory: Support customer trust initiatives by reviewing contracts for security and privacy requirements, completing detailed customer security questionnaires, and maintaining the customer trust portal.

Cross-Functional Collaboration: Contribute precise and actionable guidance to ensure security and privacy by design for engineering, product, and business initiatives.

Stakeholder Engagement: Manage relationships and facilitate engagement with external suppliers, auditors, assessors, and enterprise prospects.

Risk Management: Identify, track, and mitigate risks related to compliance projects, continuously monitor supply chain security, and manage vendor risk.

Evangelism: Articulate Harness's security capabilities and controls clearly to enterprise customers and regulatory auditors

You have a minimum of 8-10 years of relevant industry experience in security, compliance, and GRC program management.

Extensive exposure to commercial industry regulations, frameworks, and compliance certifications (ISO 27001, SOC 1, SOC 2, PCI-DSS, HIPAA).

Previous experience with GRC tools and a demonstrated ability to build automation for security and compliance controls in a cloud-native environment (AWS, GCP, or Azure).

Working knowledge or exposure to Federal compliance frameworks (e.g., NIST 800-53, FedRAMP, CMMC) and are interested in expanding these programs.

You possess strong cybersecurity acumen and solid technical proficiency with enterprise SaaS applications and infrastructure.

Excellent project management and organizational skills, with the ability to handle multiple priorities and build new programs from scratch.

Clear, concise communication skills, both written and verbal, and can effectively partner with technical engineering teams as well as non-technical stakeholders.

You are comfortable navigating ambiguity and driving clarity in complex, fast-paced situations.

You have hands-on experience building, delivering, or managing a FedRAMP-compliant service offering (FedRAMP Moderate+) or achieving an ATO.

Familiarity with specialized defense/federal environments like Platform One, Iron Bank, CMMC, or DoD IL.

You are familiar with what is going on under the hood of the AWS or GCP console and can speak to best practices for configuration and management.

You hold relevant security or technical certifications (ISO 27001 Lead Implementer/Auditor, PCI QSA, CISA, CISSP, PMP, AWS/GCP Professional, or FedRAMP-specific credentials).

Previous experience assessing and utilizing AI in a secure environment.

You have exposure to or experience with Kubernetes, SBOMs, SLSA, and/or DLP.

You like to "automate the boring stuff" and are eager to share your knowledge with junior colleagues

Competitive salary

Comprehensive healthcare benefits

Flexible Spending Account (FSA)

Flexible work schedule

Employee Assistance Program (EAP)

Flexible Time Off and Parental Leave

Monthly, quarterly, and annual social and team building events

Monthly internet reimbursement

The anticipated base salary range for this position is between $160,000 and $190,000 annually. Salary is determined by a combination of factors including location, level, relevant experience, and skills. The range displayed on each job posting reflects the minimum and maximum target for new hire salaries for the position across all US locations. The compensation package for this position may also include equity, and benefits. More details about our company benefits can be found at the following link: https://www.harness.io/company/careers.

Accelerating Our Mission to Bring AI to Everything After Code

Goldman Sachs leads investment in software delivery startup Harness at $5.5 billion valuation

How Harness runs 16 “startups within a startup” at scale | Jyoti Bansal

Harness Research Shows AI Visibility Crisis Fueling Security Nightmare

Harness has been named to the Inc. Power Partner list for software delivery success

All qualified applicants will receive consideration for employment without regard to race, color, religion, sex or national origin.

At Harness, we care about your privacy and are committed to protecting your personal data. For additional information on this topic, you can visit our privacy Portal: https://harness-privacy.relyance.ai/

Note on Fraudulent Recruiting/Offers

We have become aware that there may be fraudulent recruiting attempts being made by people posing as representatives of Harness. These scams may involve fake job postings, unsolicited emails, or messages claiming to be from our recruiters or hiring managers.

Please note, we do not ask for sensitive or financial information via chat, text, or social media, and any email communications will come from the domain @harness.io. Additionally, Harness will never ask for any payment, fee to be paid, or purchases to be made by a job applicant. All applicants are encouraged to apply directly to our open jobs via our website. Interviews are generally conducted via Zoom video conference unless the candidate requests other accommodations.

If you believe that you have been the target of an interview/offer scam by someone posing as a representative of Harness, please do not provide any personal or financial information and contact us immediately at [email protected]. You can also find additional information about this type of scam and report any fraudulent employment offers via the Federal Trade Commission’s website ( https://consumer.ftc.gov/articles/job-scams), or you can contact your local law enforcement agency.