Staff Security Analyst - GRC

We need to output HTML fragment with sections: About the role, Responsibilities, Requirements, Qualifications, Skills, Benefits, Pay, Schedule. Only include sections that have real specific content. We must not repeat job title. Must not include Job ID etc. Must preserve all substantive info, no invention. Remove boilerplate, navigation, legal, EEO, scam warning, duplicated lines, application instructions. We need to parse the posting. Key sections: - Position Summary: description of role. Could be "About the role". We'll put that under

About the role

with paragraphs. - About The Role: bullet list of responsibilities. We'll put under

Responsibilities

with

• items. - About You: qualifications/experience. Could be split into Requirements, Qualifications, Skills. The posting lists: minimum 8-10 years experience, exposure to commercial regulations, previous experience with GRC tools, working knowledge of Federal compliance frameworks, strong cybersecurity acumen, technical proficiency, project management, communication skills, comfortable navigating ambiguity. Then Bonus Points: hands-on FedRAMP, familiarity with defense/federal, familiarity with AWS/GCP console, certifications, previous experience assessing AI in secure environment, exposure to Kubernetes, SBOMs, SLSA, DLP, like to automate. We need to decide sections: Requirements (must-haves), Qualifications (maybe certifications), Skills (technical). But we can combine if content thin. However we need to avoid filler sections. We'll include sections only if we have specific content. We have: - Requirements: minimum 8-10 years experience, exposure to commercial industry regulations/frameworks (ISO 27001, SOC 1, SOC 2, PCI-DSS, HIPAA), previous experience with GRC tools and ability to build automation for security and compliance controls in cloud-native environment (AWS, GCP, Azure), working knowledge or exposure to Federal compliance frameworks (NIST 800-53, FedRAMP, CMMC), strong cybersecurity acumen and solid technical proficiency with enterprise SaaS applications and infrastructure, excellent project management and organizational skills, ability to handle multiple priorities and build new programs from scratch, clear concise communication skills, comfortable navigating ambiguity. - Qualifications: maybe certifications: ISO 27001 Lead Implementer/Auditor, PCI QSA, CISA, CISSP, PMP, AWS/GCP Professional, or FedRAMP-specific credentials. Also bonus points: hands-on experience building FedRAMP-compliant service offering, familiarity with specialized defense/federal environments, familiarity with AWS/GCP console best practices, previous experience assessing and utilizing AI in a secure environment, exposure to or experience with Kubernetes, SBOMs, SLSA, DLP, like to automate. - Skills: maybe technical skills: GRC tools, automation, CI/CD integration, cloud-native, etc. But we can incorporate into Requirements. We also have Benefits: list: Competitive salary, Comprehensive healthcare benefits, Flexible Spending Account (FSA), Flexible work schedule, Employee Assistance Program (EAP), Flexible Time Off and Parental Leave, Monthly, quarterly, and annual social and team building events, Monthly internet reimbursement. Pay: anticipated base salary range $150,000-$164,000 annually. Also mention equity may be included. Schedule: Flexible work schedule mentioned under benefits; also Work Location: Remote within the U.S or Hybrid from one of our offices. That's location, not schedule. Schedule maybe "Flexible work schedule". Could be separate Schedule section. We must not create sections with filler like "commensurate with experience". We have actual content. Thus sections:

  About the role

  (position summary paragraph)

  Responsibilities

  (list from About The Role)

  Requirements

  (must-haves from About You)

  Qualifications

  (certifications and bonus points maybe)

  Benefits

  (list)

  Pay

  (salary range)

  Schedule

  (flexible work schedule) We need to ensure we don't duplicate content. Also we must not include navigation/legal etc. Remove duplicated lines. Let's extract exact text. Position Summary paragraph: "Harness is the AI Software Delivery Platform company, led by technologist and entrepreneur Jyoti Bansal (founder of AppDynamics, acquired by Cisco for $3.7B). Harness has raised approximately $570M in funding and is valued at $5.5B, backed by leading investors including Goldman Sachs, Menlo Ventures, IVP, Unusual Ventures, Citi Ventures, and more. As AI accelerates code creation, the real bottleneck has shifted to everything after the code – testing, deployments, application security, reliability, compliance, and cost optimization. Harness brings AI and automation to this “outer loop,” helping teams ship software faster while maintaining security and governance throughout the entire software delivery lifecycle. Powered by Harness AI and the Software Delivery Knowledge Graph, the Harness Platform applies deep context and intelligent automation across the software delivery lifecycle with governance and policy-driven controls embedded throughout the platform. Over the past year, Harness powered over 185M deployments, 82M builds, 18T flag evaluations, 8M security scans, 9.1B optimized tests, 3T protected API calls, and helped manage $2.8B in cloud spend — enabling customers like United Airlines, Morningstar, and Choice Hotels to accelerate releases by up to 75%, reduce cloud costs by up to 60%, and achieve 10x DevOps efficiency. With a global team across 26 offices and 27 countries, Harness is shaping the future of AI software delivery — and we’re looking for exceptional talent to help us move even faster." Then "Position Summary A Staff Security Analyst will be a critical member of the GRC team working within the Information Security organization and across the business to advise, build, and operate security and compliance programs at scale. Utilizing in-depth expertise across multiple disciplines, you will be responsible for executing various components of Harness' security posture and overseeing end-to-end solutions to complex compliance problems. As a Staff Security Analyst, you will lead security efforts to acquire and maintain crucial compliance certifications across Commercial sectors while assisting with Federal initiatives. You will design solutions that enable Harness' security goals and collaborate directly with business and engineering teams to preserve velocity while ensuring top-tier security. This role requires a strong core in Commercial Compliance mastery (SOC 2, SOC 1, ISO 27k, HIPAA, PCI), Customer Trust experience, and hands-on GRC Engineering and Automation capabilities, complemented by familiarity with Federal Compliance (FedRAMP, NIST 800-53)." We could combine the two paragraphs as About the role. Now About The Role bullet list: - Commercial Compliance Management: Design, implement, and continuously monitor commercial compliance controls, collaborating with engineering teams to ensure environments are properly scoped and secured for SOC 1, SOC 2, ISO 27001, PCI-DSS, and HIPAA. - GRC Engineering & Automation: Develop and implement automation solutions to scale compliance tasks, automate control testing, integrate continuous compliance checks into the CI/CD pipeline, and streamline reporting. - Federal Compliance Support: Contribute to Federal compliance initiatives and frameworks (such as FedRAMP Moderate+, CMMC, DoD IL, and FedRAMP 20x) as Harness expands its public sector footprint. - Customer Trust & Advisory: Support customer trust initiatives by reviewing contracts for security and privacy requirements, completing detailed customer security questionnaires, and maintaining the customer trust portal. - Cross-Functional Collaboration: Contribute precise and actionable guidance to ensure security and privacy by design for engineering, product, and business initiatives. - Stakeholder Engagement: Manage relationships and facilitate engagement with external suppliers, auditors, assessors, and enterprise prospects. - Risk Management: Identify, track, and mitigate risks related to compliance projects, continuously monitor supply chain security, and manage vendor risk. - Evangelism: Articulate Harness's security capabilities and controls clearly to enterprise customers and regulatory auditors. Now About You bullet list (must-haves): - You have a minimum of 8-10 years of relevant industry experience in security, compliance, and GRC program management. - Extensive exposure to commercial industry regulations, frameworks, and compliance certifications (ISO 27001, SOC 1, SOC 2, PCI-DSS, HIPAA). - Previous experience with GRC tools and a demonstrated ability to build automation for security and compliance controls in a cloud-native environment (AWS, GCP, or Azure). - Working knowledge or exposure to Federal compliance frameworks (e.g., NIST 800-53, FedRAMP, CMMC) and are interested in expanding these programs. - You possess strong cybersecurity acumen and solid technical proficiency with enterprise SaaS applications and infrastructure. - Excellent project management and organizational skills, with the ability to handle multiple priorities and build new programs from scratch. - Clear, concise communication skills, both written and verbal, and can effectively partner with technical engineering teams as well as non-technical stakeholders. - You are comfortable navigating ambiguity and driving clarity in complex, fast-paced situations. Bonus Points: - You have hands-on experience building, delivering, or managing a FedRAMP-compliant service offering (FedRAMP Moderate+) or achieving an ATO. - Familiarity with specialized defense/federal environments like Platform One, Iron Bank, CMMC, or DoD IL. - You are familiar with what is going on under the hood of the AWS or GCP console and can speak to best practices for configuration and management. - You hold relevant security or technical certifications (ISO 27001 Lead Implementer/Auditor, PCI QSA, CISA, CISSP, PMP, AWS/GCP Professional, or FedRAMP-specific credentials). - Previous experience assessing and utilizing AI in a secure environment. - You have exposure to or experience with Kubernetes, SBOMs, SLSA, and/or DLP. - You like to "automate the boring stuff" and are eager to share your knowledge with junior colleagues. Work Location: Remote within the U.S or Hybrid from one of our offices. Benefits list: - Competitive salary - Comprehensive healthcare benefits - Flexible Spending Account (FSA) - Flexible work schedule - Employee Assistance Program (EAP) - Flexible Time Off and Parental Leave - Monthly, quarterly, and annual social and team building events - Monthly internet reimbursement Pay: "The anticipated base salary range for this position is between $150,000 and $164,000 annually. Salary is determined by a combination of factors including location, level, relevant experience, and skills. The range displayed on each job posting reflects the minimum and maximum target for new hire salaries for the position across all US locations. The compensation package for this position may also include equity, and benefits." We can summarize as Pay: $150,000—$164,000 USD base salary, plus potential equity. Schedule: Flexible work schedule (already in benefits). Could also note remote/hybrid location but that's not schedule. We'll create Schedule section with "Flexible work schedule" maybe also mention remote/hybrid? But schedule is about hours, not location. We'll keep schedule as flexible work schedule. Now we need to output HTML fragment only, no markdown fences. We'll produce:

  About the role

  ... (combined position summary paragraphs)

  Responsibilities

  • ...
  ...

  Requirements

  • ...
  ...

  Qualifications

  • ...
  ...

  Benefits

  • ...
  ...

  Pay