[All remote jobs](https://jobicy.com/jobs.md)[![Harness logo](https://jobicy.com/data/server-nyc0409/galaxy/mercury/2022/01/3b1ed4078f521827fd4fd3f1ead4e484.jpg)](https://jobicy.com/company/harness.md)[Harness](https://jobicy.com/company/harness.md) # Staff Security Analyst – GRC Review the role, location requirements, compensation details, and application process before deciding whether this opportunity fits your next career move. [Apply for this job](#job-application)[View company](https://jobicy.com/company/harness.md)ShareRemote from[USA](https://jobicy.com/job-region/usa.md)SalaryUSD 150k–164k / yrDepartment[Cybersecurity](https://jobicy.com/categories/cybersecurity.md)EmploymentFull TimeExperienceSeniorPublished2 Nov 2026Apply before2 Dec 2026Listing views25Application actions2Application toolkit ## Make your next move. Prepare your resume, explore your fit, and draft a cover letter for this opportunity. AI Summary ## The role, at a glance. This Staff Security Analyst role leads GRC and commercial compliance work for a cloud-native software delivery platform. The position owns the design, operation, and automation of controls supporting SOC 1, SOC 2, ISO 27001, PCI-DSS, and HIPAA, while contributing to federal compliance initiatives such as FedRAMP and CMMC. It also supports customer trust activities, vendor risk management, audit engagement, and security guidance for engineering and business stakeholders. The role requires substantial hands-on security, cloud, automation, program-management, and communication expertise. It is remote within the United States, with an optional hybrid office alternative. ## Role DNA A quick view of the complexity, pace, ownership and collaboration implied by the job description. ### Job Complexity 5/5EasyHard ### Pace & Pressure 5/5RelaxedFast-paced ### Autonomy Level 5/5GuidedFull ownership ### Communication Load 5/5IndependentCollaborative AI insightThis is a staff-level role requiring 8–10 years of experience across several complex commercial frameworks, cloud security, control automation, and customer-facing assurance work. The incumbent must independently build scalable programs while balancing fast-moving engineering priorities, auditors, prospects, and federal compliance expansion. ## Salary analysis Estimated compensation compared with the broader US market for similar roles. Estimated job median (per year)Market rate$157,000US market range (per year)$150k–$190k0$209.00k AI insightThe yearly pay period is inferred from the job context; it was not explicitly stated by the employer. The employer explicitly lists a base salary range of $150,000–$164,000 USD annually, with a midpoint of $157,000. Estimated US market pay for a staff-level GRC/security compliance professional is approximately $150,000–$190,000 annually; actual pay varies with cloud-security depth, FedRAMP experience, location, and scope of program ownership. ## Core skills Skills and capabilities most closely associated with this opportunity. [Governance, Risk and Compliance](https://jobicy.com/jobs?search_keywords=Governance%20Risk%20and%20Compliance.md)[SOC 2](https://jobicy.com/jobs?search_keywords=SOC%202.md)[SOC 1](https://jobicy.com/jobs?search_keywords=SOC%201.md)[ISO 27001](https://jobicy.com/jobs?search_keywords=ISO%2027001.md)[PCI-DSS](https://jobicy.com/jobs?search_keywords=PCI-DSS.md)[HIPAA](https://jobicy.com/jobs?search_keywords=HIPAA.md)[FedRAMP](https://jobicy.com/jobs?search_keywords=FedRAMP.md)[NIST 800-53](https://jobicy.com/jobs?search_keywords=NIST%20800-53.md)[CMMC](https://jobicy.com/jobs?search_keywords=CMMC.md)[Cloud Security](https://jobicy.com/jobs?search_keywords=Cloud%20Security.md)[AWS](https://jobicy.com/jobs?search_keywords=AWS.md)[GCP](https://jobicy.com/jobs?search_keywords=GCP.md)[Compliance Automation](https://jobicy.com/jobs?search_keywords=Compliance%20Automation.md)[Vendor Risk Management](https://jobicy.com/jobs?search_keywords=Vendor%20Risk%20Management.md)[Customer Trust](https://jobicy.com/jobs?search_keywords=Customer%20Trust.md) Sample interview questionsHow would you design a scalable compliance-control program for SOC 2 and ISO 27001 in a cloud-native environment?I would begin with a unified control inventory mapped to both frameworks, define control owners and evidence requirements, and prioritize high-risk systems and data flows. I would automate evidence collection and continuous checks through cloud configuration, CI/CD, identity, and ticketing integrations, then use clear exception and remediation workflows to maintain audit readiness. Describe how you would integrate continuous compliance checks into a CI/CD pipeline. I would identify policy-as-code checks relevant to infrastructure, secrets, dependency risk, access controls, and deployment approvals. These checks should run at pull request and deployment stages, produce actionable findings, and feed exceptions into a tracked workflow with ownership, due dates, and compensating-control documentation. How do you balance customer security questionnaire demands with internal engineering velocity? I maintain a current trust portal, reusable approved responses, and an evidence library to address common requests quickly. For novel requests, I triage by customer risk and commercial priority, translate requirements into concrete technical questions, and avoid creating unplanned commitments without appropriate security and engineering review. What is your approach to preparing for a FedRAMP Moderate initiative while maintaining commercial compliance obligations? I would perform a gap assessment against NIST 800-53, map common controls to existing SOC 2 and ISO practices, and establish a prioritized remediation roadmap. I would also define system boundaries, evidence standards, authorization ownership, and recurring governance so that federal requirements become an operational program rather than a one-time audit project. How would you manage a material vendor-risk finding involving a critical SaaS supplier? I would assess the finding's impact on confidentiality, integrity, availability, and regulatory obligations, then validate the supplier's remediation plan and timelines. If the residual risk remains unacceptable, I would recommend compensating controls, contractual actions, alternative suppliers, or executive risk acceptance with documented ownership and review dates. Opportunity details ## About this role. Harness is the AI Software Delivery Platform company, led by technologist and entrepreneur Jyoti Bansal (founder of AppDynamics, acquired by Cisco for $3.7B). Harness has raised approximately $570M in funding and is valued at $5.5B, backed by leading investors including Goldman Sachs, Menlo Ventures, IVP, Unusual Ventures, Citi Ventures, and more. As AI accelerates code creation, the real bottleneck has shifted to everything after the code – testing, deployments, application security, reliability, compliance, and cost optimization. Harness brings AI and automation to this “outer loop,” helping teams ship software faster while maintaining security and governance throughout the entire software delivery lifecycle. Powered by Harness AI and the Software Delivery Knowledge Graph, the Harness Platform applies deep context and intelligent automation across the software delivery lifecycle with governance and policy-driven controls embedded throughout the platform. Over the past year, Harness powered over 185M deployments, 82M builds, 18T flag evaluations, 8M security scans, 9.1B optimized tests, 3T protected API calls, and helped manage $2.8B in cloud spend — enabling customers like United Airlines, Morningstar, and Choice Hotels to accelerate releases by up to 75%, reduce cloud costs by up to 60%, and achieve 10x DevOps efficiency. With a global team across 26 offices and 27 countries, Harness is shaping the future of AI software delivery — and we’re looking for exceptional talent to help us move even faster. ### Position Summary A Staff Security Analyst will be a critical member of the GRC team working within the Information Security organization and across the business to advise, build, and operate security and compliance programs at scale. Utilizing in-depth expertise across multiple disciplines, you will be responsible for executing various components of Harness’ security posture and overseeing end-to-end solutions to complex compliance problems. As a Staff Security Analyst, you will lead security efforts to acquire and maintain crucial compliance certifications across Commercial sectors while assisting with Federal initiatives. You will design solutions that enable Harness’ security goals and collaborate directly with business and engineering teams to preserve velocity while ensuring top-tier security. This role requires a strong core in Commercial Compliance mastery (SOC 2, SOC 1, ISO 27k, HIPAA, PCI), Customer Trust experience, and hands-on GRC Engineering and Automation capabilities, complemented by familiarity with Federal Compliance (FedRAMP, NIST 800-53). ### About the role * Commercial Compliance Management: Design, implement, and continuously monitor commercial compliance controls, collaborating with engineering teams to ensure environments are properly scoped and secured for SOC 1, SOC 2, ISO 27001, PCI-DSS, and HIPAA. * GRC Engineering & Automation: Develop and implement automation solutions to scale compliance tasks, automate control testing, integrate continuous compliance checks into the CI/CD pipeline, and streamline reporting. * Federal Compliance Support: Contribute to Federal compliance initiatives and frameworks (such as FedRAMP Moderate+, CMMC, DoD IL, and FedRAMP 20x) as Harness expands its public sector footprint. * Customer Trust & Advisory: Support customer trust initiatives by reviewing contracts for security and privacy requirements, completing detailed customer security questionnaires, and maintaining the customer trust portal. * Cross-Functional Collaboration: Contribute precise and actionable guidance to ensure security and privacy by design for engineering, product, and business initiatives. * Stakeholder Engagement: Manage relationships and facilitate engagement with external suppliers, auditors, assessors, and enterprise prospects. * Risk Management: Identify, track, and mitigate risks related to compliance projects, continuously monitor supply chain security, and manage vendor risk. * Evangelism: Articulate Harness’s security capabilities and controls clearly to enterprise customers and regulatory auditors ### About you * You have a minimum of 8-10 years of relevant industry experience in security, compliance, and GRC program management. * Extensive exposure to commercial industry regulations, frameworks, and compliance certifications (ISO 27001, SOC 1, SOC 2, PCI-DSS, HIPAA). * Previous experience with GRC tools and a demonstrated ability to build automation for security and compliance controls in a cloud-native environment (AWS, GCP, or Azure). * Working knowledge or exposure to Federal compliance frameworks (e.g., NIST 800-53, FedRAMP, CMMC) and are interested in expanding these programs. * You possess strong cybersecurity acumen and solid technical proficiency with enterprise SaaS applications and infrastructure. * Excellent project management and organizational skills, with the ability to handle multiple priorities and build new programs from scratch. * Clear, concise communication skills, both written and verbal, and can effectively partner with technical engineering teams as well as non-technical stakeholders. * You are comfortable navigating ambiguity and driving clarity in complex, fast-paced situations. ### Bonus Points! * You have hands-on experience building, delivering, or managing a FedRAMP-compliant service offering (FedRAMP Moderate+) or achieving an ATO. * Familiarity with specialized defense/federal environments like Platform One, Iron Bank, CMMC, or DoD IL. * You are familiar with what is going on under the hood of the AWS or GCP console and can speak to best practices for configuration and management. * You hold relevant security or technical certifications (ISO 27001 Lead Implementer/Auditor, PCI QSA, CISA, CISSP, PMP, AWS/GCP Professional, or FedRAMP-specific credentials). * Previous experience assessing and utilizing AI in a secure environment. * You have exposure to or experience with Kubernetes, SBOMs, SLSA, and/or DLP. * You like to “automate the boring stuff” and are eager to share your knowledge with junior colleagues ### Work Location * Remote within the U.S or Hybrid from one of our offices. ### What you will have at Harness * Competitive salary * Comprehensive healthcare benefits * Flexible Spending Account (FSA) * Flexible work schedule * Employee Assistance Program (EAP) * Flexible Time Off and Parental Leave * Monthly, quarterly, and annual social and team building events * Monthly internet reimbursement The anticipated base salary range for this position is between $150,000 and $164,000 annually. Salary is determined by a combination of factors including location, level, relevant experience, and skills. The range displayed on each job posting reflects the minimum and maximum target for new hire salaries for the position across all US locations. The compensation package for this position may also include equity, and benefits. More details about our company benefits can be found at the following link: https://www.harness.io/company/careers. Pay transparency $150,000—$164,000 USD ### Harness in the news: * [Accelerating Our Mission to Bring AI to Everything After Code](https://www.harness.io/blog/240m-financing-to-bring-ai-to-everything-after-code) * [Goldman Sachs leads investment in software delivery startup Harness at $5.5 billion valuation](https://www.cnbc.com/2025/12/11/harness-is-worth-5point5-billion-in-round-led-by-goldman-sachs.html) * [How Harness runs 16 “startups within a startup” at scale | Jyoti Bansal](https://www.youtube.com/watch?v=LvOYXKAyAqs) * [Harness Research Shows AI Visibility Crisis Fueling Security Nightmare](https://www.digit.fyi/ai-visibility-crisis-fuelling-security-nightmare/) * [Harness has been named to the Inc. Power Partner list for software delivery success](https://www.harness.io/blog/we-made-inc-s-2025-power-partners-list-again---heres-why-it-matters) All qualified applicants will receive consideration for employment without regard to race, color, religion, sex or national origin. At Harness, we care about your privacy and are committed to protecting your personal data. For additional information on this topic, you can visit our privacy Portal: [https://harness-privacy.relyance.ai/](https://harness-privacy.relyance.ai/) Note on Fraudulent Recruiting/Offers We have become aware that there may be fraudulent recruiting attempts being made by people posing as representatives of Harness. These scams may involve fake job postings, unsolicited emails, or messages claiming to be from our recruiters or hiring managers. Please note, we do not ask for sensitive or financial information via chat, text, or social media, and any email communications will come from the domain @harness.io. Additionally, Harness will never ask for any payment, fee to be paid, or purchases to be made by a job applicant. All applicants are encouraged to apply directly to our open jobs via our website. Interviews are generally conducted via Zoom video conference unless the candidate requests other accommodations. If you believe that you have been the target of an interview/offer scam by someone posing as a representative of Harness, please do not provide any personal or financial information and contact us immediately at [security@harness.io](mailto:security@harness.io). You can also find additional information about this type of scam and report any fraudulent employment offers via the Federal Trade Commission’s website ([https://consumer.ftc.gov/articles/job-scams)](https://consumer.ftc.gov/articles/job-scams)), or you can contact your local law enforcement agency. Show more [Apply now >](https://jobicy.com/jobs/158473-staff-security-analyst-grc.md) * ![Upload CV](data:image/svg+xml;base64,PHN2ZyB4bWxucz0iaHR0cDovL3d3dy53My5vcmcvMjAwMC9zdmciIHdpZHRoPSI2NSIgaGVpZ2h0PSI2NSIgZmlsbD0ibm9uZSIgeG1sbnM6dj0iaHR0cHM6Ly92ZWN0YS5pby9uYW5vIj48ZyBjbGlwLXBhdGg9InVybCgjQSkiPjxwYXRoIGQ9Ik0wIDBINjVWNjVIMFYwWiIgZmlsbD0iIzAyOWFlYiIvPjxnIGZpbGw9IiNmZmYiIHN0cm9rZT0iI2ZmZiIgc3Ryb2tlLXdpZHRoPSIyIj48cGF0aCBkPSJNMzMuMDQ5IDE1LjQ1NGExLjQzIDEuNDMgMCAwIDAtMi4wOTcgMGwtNy41NzkgOC4xNDdhMS4zOCAxLjM4IDAgMCAwIC4wOSAxLjk3MyAxLjQ0IDEuNDQgMCAwIDAgMi4wMDgtLjA4OGw1LjEwOS01LjQ5MnYyMC42MWExLjQxIDEuNDEgMCAwIDAgMS40MjEgMS4zOTdjLjc4NSAwIDEuNDIxLS42MjUgMS40MjEtMS4zOTd2LTIwLjYxbDUuMTA5IDUuNDkyYTEuNDQgMS40NCAwIDAgMCAyLjAwOC4wODggMS4zOCAxLjM4IDAgMCAwIC4wOS0xLjk3M2wtNy41NzktOC4xNDZ6TTE2Ljc2OSAzOC40YzAtLjc3My0uNjItMS40LTEuMzg1LTEuNFMxNCAzNy42MjcgMTQgMzguNHYuMTAybC4yMTUgNi4yMjljLjIyMyAxLjY4LjcwMSAzLjA5NSAxLjgxMyA0LjIxOHMyLjUxIDEuNjA3IDQuMTcyIDEuODMzYzEuNi4yMTggMy42MzYuMjE4IDYuMTYuMjE4aDExLjI4bDYuMTYtLjIxOGMxLjY2Mi0uMjI2IDMuMDYxLS43MDkgNC4xNzItMS44MzNzMS41ODktMi41MzggMS44MTMtNC4yMThDNTAgNDMuMTEzIDUwIDQxLjA1NSA1MCAzOC41MDNWMzguNGMwLS43NzMtLjYyLTEuNC0xLjM4NS0xLjRzLTEuMzg1LjYyNy0xLjM4NSAxLjRsLS4xOSA1Ljk1OGMtLjE4MiAxLjM3LS41MTUgMi4wOTUtMS4wMjYgMi42MTJzLTEuMjI4Ljg1My0yLjU4MyAxLjAzOGMtMS4zOTUuMTktMy4yNDMuMTkzLTUuODkzLjE5M0gyNi40NjJjLTIuNjUgMC00LjQ5OC0uMDAzLTUuODkzLS4xOTMtMS4zNTUtLjE4NC0yLjA3Mi0uNTIxLTIuNTgzLTEuMDM4cy0uODQ0LTEuMjQyLTEuMDI2LTIuNjEyYy0uMTg3LTEuNDEtLjE5MS0zLjI3OS0uMTkxLTUuOTU4eiIvPjwvZz48L2c+PGRlZnM+PGNsaXBQYXRoIGlkPSJBIj48cGF0aCBmaWxsPSIjZmZmIiBkPSJNMCAwaDY1djY1SDB6Ii8+PC9jbGlwUGF0aD48L2RlZnM+PC9zdmc+) ### Upload your resume now To unlock remote work opportunities and be discovered by global employers. This job listing has been manually reviewed by the Jobicy Trust & Safety Team for compliance with our posting guidelines, including verification of the company's legitimacy, accuracy of job details, clarity of remote work policy, and absence of misleading or fraudulent content. Next step ## Apply now. Follow the employer’s application method and review Jobicy’s safety guidance before sharing personal information. Keep exploring ## Related remote jobs. * ![Reddit logo](https://jobicy.com/data/server-nyc0409/galaxy/mercury/2020/10/Reddit.jpg) Reddit Nov 2 New ### [Staff Product Security Engineer](https://jobicy.com/jobs/152256-staff-product-security-engineer.md) Reddit is a community of communities. It’s built on shared interests, passion, and trust, and is home to the most open and authentic conversations on the internet. Every day, Reddit… * ![Maven Clinic logo](https://jobicy.com/data/server-nyc0409/galaxy/mercury/2026/07/c4b2d5ecf34b-221.webp) Maven Clinic Nov 2 New ### [Staff Software Engineer – Product Security](https://jobicy.com/jobs/152250-staff-software-engineer-product-security.md) Maven Clinic is the world’s largest virtual clinic for women and families on a mission to make healthcare work for all of us. Through Maven Enterprise, the company partners with… * ![YipitData logo](https://jobicy.com/data/server-nyc0409/galaxy/mercury/2025/06/e1bee9df-221.jpg) YipitData Nov 2 New ### [Product Security Engineer](https://jobicy.com/jobs/152175-product-security-engineer.md) About Us: YipitData is the leading market research and analytics firm for the disruptive economy and most recently raised $475M from The Carlyle Group at a valuation of over $1B…. * ![Spotify logo](https://jobicy.com/data/server-nyc0409/galaxy/mercury/2021/03/Jobicy-210328105941-289246.jpg) Spotify Nov 1 New ### [Security Engineer – Detection and Response](https://jobicy.com/jobs/158384-security-engineer-detection-and-response-2.md) The Platform team creates the technology that enables Spotify to learn quickly and scale easily, enabling rapid growth in our users and our business around the globe. Spanning many disciplines,… * ![TRM Labs logo](https://jobicy.com/data/server-nyc0409/galaxy/mercury/2025/06/34aa038c-221.png) TRM Labs Nov 1 New ### [Senior All-Source Intelligence Analyst](https://jobicy.com/jobs/154320-senior-all-source-intelligence-analyst.md) Build a Safer World. TRM Labs provides AI-powered intelligence solutions that help public and private sector agencies investigate and disrupt crime. TRM’s platforms enable investigators to trace illicit activity, build… * ![ExtraHop logo](https://jobicy.com/data/server-nyc0409/galaxy/mercury/2025/06/4800f505-221.jpg) ExtraHop Oct 31 New ### [Solutions Architect III](https://jobicy.com/jobs/158258-solutions-architect-iii.md) At ExtraHop, we’re on a mission to protect and empower the connected enterprise. We reveal what is happening in the very infrastructure that sustains businesses, lives, and communities, and ensure… * ![ExtraHop logo](https://jobicy.com/data/server-nyc0409/galaxy/mercury/2025/06/4800f505-221.jpg) ExtraHop Oct 31 New ### [Senior Solutions Architect](https://jobicy.com/jobs/158252-senior-solutions-architect-4.md) At ExtraHop, we’re on a mission to protect and empower the connected enterprise. We reveal what is happening in the very infrastructure that sustains businesses, lives, and communities, and ensure… * ![Twilio logo](https://jobicy.com/data/server-nyc0409/galaxy/mercury/2020/10/WRILS-201023175858-722503.jpg) Twilio Oct 31 New ### [Emerging Fraud Researcher](https://jobicy.com/jobs/158251-emerging-fraud-researcher.md) Who we are At Twilio, we’re shaping the future of communications, all from the comfort of our homes. We deliver innovative solutions to hundreds of thousands of businesses and empower… * ![ExtraHop logo](https://jobicy.com/data/server-nyc0409/galaxy/mercury/2025/06/4800f505-221.jpg) ExtraHop Oct 31 New ### [Senior Security Solutions Architect](https://jobicy.com/jobs/158229-senior-security-solutions-architect.md) At ExtraHop, we’re on a mission to protect and empower the connected enterprise. We reveal what is happening in the very infrastructure that sustains businesses, lives, and communities, and ensure… * ![Thumbtack logo](https://jobicy.com/data/server-nyc0409/galaxy/mercury/2021/05/Jobicy-210503180426-842530.jpg) Thumbtack Oct 31 New ### [Application Security Engineer II](https://jobicy.com/jobs/158220-application-security-engineer-ii.md) Thumbtack helps millions of people confidently care for their homes. Thumbtack is the one app you need to take care of and improve your home — from personalized guidance to… [Browse all jobs](https://jobicy.com/jobs.md)