Sr. Cyber Assurance Analyst, Data Centers

We need to output HTML fragment with headings

for sections: About the role, Responsibilities, Requirements, Qualifications, Skills, Benefits, Pay, Schedule. Only include sections that have real specific content. The posting content. We must not repeat job title as heading. No Job ID etc. Remove boilerplate like EEO, ITAR, etc. Must preserve all substantive info. We need to parse the posting. Job title: SR. CYBER ASSURANCE ANALYST, DATA CENTERS We need sections: - About the role: likely the introductory paragraph(s) describing role: "SpaceX was founded..." etc. Also description of Cyber Assurance practice and what you will do. So we can put that under About the role. - Responsibilities: list of responsibilities bullet points. - Requirements: Basic Qualifications? The posting has "Basic Qualifications" and "Preferred Skills And Experience" and "Additional Requirements". We need to map to sections: Requirements, Qualifications, Skills, Benefits, Pay, Schedule. We need to decide which sections have content. - Requirements: could be Basic Qualifications (high school diploma, 5+ years experience etc). That's requirements. - Qualifications: maybe Preferred Skills And Experience? Or could be "Professional certifications". Might be separate. - Skills: maybe the list of skills under Preferred Skills And Experience? Or we could combine. - Benefits: posting does not mention benefits explicitly. No mention of benefits, pay, schedule. So we should NOT include Benefits, Pay, Schedule sections because they are not stated. The instruction: never create Pay/Schedule/Benefits sections unless posting actually states them. So we omit those. Thus we will have sections: About the role, Responsibilities, Requirements, Qualifications, Skills. Check if any content for Skills separate from Qualifications: The posting has "Preferred Skills And Experience" which includes many bullet-like sentences. Could treat that as Skills. Also "Professional certifications such as ..." could be part of Qualifications or Skills. We'll decide. We need to preserve all substantive info; not invent or summarize away detail. So we need to include all bullet points from Responsibilities, Basic Qualifications, Preferred Skills And Experience, Additional Requirements (location, onsite, travel, extended hours, ITAR). Also maybe "Additional Requirements" includes location, onsite, travel, extended hours, ITAR. Those are requirements (maybe under Requirements or Additional Requirements). Since we have a Requirements section, we can include those there. We must not include boilerplate: EEO, ITAR? Actually ITAR is a requirement (citizenship etc). That is substantive; we should keep it. The ITAR paragraph is a requirement; we should include it. The EEO statement is boilerplate; we should remove it. Also the "Learn more about the ITAR here." link maybe remove. Also "SpaceX is an Equal Opportunity Employer..." remove. Also "Applicants wishing to view a copy..." remove. Also "Additional Requirements This position is based in Memphis, TN. This role requires you to be onsite; remote/hybrid work will not be considered.Must be willing to travel (About the role

then

...

maybe multiple paragraphs. Responsibilities:

Responsibilities

then

• ... each responsibility. We need to preserve all responsibility bullet points exactly as in posting. Let's extract them. From posting after "Responsibilities": "Own and execute information security compliance and certification for the data center portfolio across ISO/IEC 27001, ISO/IEC 42001, and SOC 2 (Type I/Type II), including control mapping, gap assessment, evidence collection, testing support, and remediation tracking." "Build and maintain audit-ready evidence packages for data center information security controls — including logical and physical access control, logging and monitoring, change management, vulnerability management, media handling, and availability-related security controls — suitable for external assessors." "Partner with engineering and system owners to gather and validate technical evidence (configurations, logs, designs, operational procedures) and to confirm controls operate as designed in production data center environments." "Plan, coordinate, and support internal and external audits and assessments for owned and operated data centers; act as a primary information security liaison to auditors for ISO 27001, ISO 42001, and SOC 2 scopes that include data center operations." "Perform information security and compliance risk assessments of data center systems, networks, and supporting processes; identify deviations from policy, standards, or framework requirements; advise on remediation; and drive timely closure with accountable owners." "Develop, maintain, and continuously improve information security policies, standards, procedures, and control documentation that support the data center ISMS / AI management system / SOC 2 control environment." "Identify and drive assurance efficiency through better evidence pipelines, tooling integration, reuse of control testing, and process improvement across sites so audit readiness scales with the portfolio rather than relying on point-in-time scrambles." "Maintain an up-to-date understanding of emerging information security risks, changes to ISO 27001 / ISO 42001 / SOC 2 expectations for data center and AI-enabled environments, and new assurance techniques; propose pragmatic, business-enabling actions." "Mentor fellow teammates and take an active role in their development." That's all. Now Basic Qualifications: "High school diploma or equivalency certificate." "5+ years of experience in cybersecurity compliance, audit or technical security roles with strong knowledge in security compliance frameworks." "5+ years of experience with control testing, security standards/policy development, security audits, or security risk management." That's three bullet points. Preferred Skills And Experience: many sentences; we can treat each as a bullet. Let's extract: "Experience liaising with Facility Operations, Physical Security, and Environmental, Health, and Safety (EHS) teams (including HVAC, fire detection/suppression, and related site systems) to obtain and validate information security-relevant evidence for ISO 27001, ISO 42001, and SOC 2 — while keeping the assurance focus on information security outcomes rather than facilities ownership." "Hands-on experience implementing or operating controls against ISO/IEC 27001 & 420001 and/or SOC 2 or equivalent industry certifications — including evidence collection and audit support." "Working knowledge of AI management systems and how AI-related controls intersect with data center and infrastructure assurance scopes." "Demonstrated ability to evaluate control objectives against enterprise grade IT, network, and infrastructure configurations and to work with technical teams on remediation." "Familiarity with data center information security control themes commonly in scope for ISO 27001 Annex A and SOC 2 (e.g., physical access and visitor management as security controls, environmental monitoring as availability/security evidence, secure media handling, and continuity interfaces) from an assurance and evidence perspective." "Ability to interpret configurations, logs, and system/network designs for compliance implications; experience with security tooling such as vulnerability scanners, SIEM, and configuration baseline checks (e.g., CIS Benchmarks)." "Direct experience supporting external ISO 27001 certification audits and/or SOC 2 examinations for infrastructure or data center scopes." "Experience with GRC or continuous compliance platforms and with improving evidence collection through automation or process redesign." "Strong communication skills across organizational levels; able to explain framework requirements and risk tradeoffs to engineers, operators, and leadership in plain language." "Project and program management experience delivering concurrent audit and remediation workstreams in highly fluid environments." "Professional certifications such as CISA, CISM, CISSP, CRISC, ISO 27001 Lead Implementer/Auditor, or equivalent." That's the list. Now Additional Requirements: "This position is based in Memphis, TN." "This role requires you to be onsite; remote/hybrid work will not be considered." "Must be willing to travel ( with line breaks? Better to separate into

  for each paragraph. We'll produce:

  About the role

  SpaceX was founded under the belief that a future where humanity is out exploring the stars is fundamentally more exciting than one where we are not. Today SpaceX is actively developing the technologies to make this possible, with the ultimate goal of enabling human life on Mars.

  SR. CYBER ASSURANCE ANALYST, DATA CENTERS Cyber Assurance is the practice of providing confidence that systems, products, and processes meet security, regulatory, and compliance obligations. It bridges governance with technical execution — validating that controls are in place, risks are managed, and requirements are met for both internal and customer-facing systems. As a teammate on the Information Assurance team, you will own and scale cyber assurance for SpaceX data centers with a primary focus on ISO/IEC 27001, ISO/IEC 42001, and SOC 2. You will operate from an information security perspective: designing and validating controls, collecting and reviewing technical and operational evidence, driving remediation, and keeping the data center portfolio audit-ready across sites. You will partner closely with engineers and cross-functional operators so controls are implemented in the environment — not only documented after the fact. The ideal candidate lives at the intersection of security, compliance,