Staff Security Analyst - GRC

We need to output only HTML fragment, no html/body tags, no markdown fences. Use

for section headings: About the role, Responsibilities, Requirements, Qualifications, Skills, Benefits, Pay, Schedule. We need to include sections only if posting has real specific content. The posting includes: description (About the role) – we can put under About the role. Responsibilities: there is a list of accountabilities (design, implement, monitor, partner, develop, streamline, support, support, provide, build, identify, track, mitigate, clearly communicate, build new programs, share knowledge). That's responsibilities. Requirements: there is a list of requirements (8–10+ years, extensive experience, experience with GRC tools, working knowledge of federal frameworks, strong cybersecurity knowledge, strong project management, excellent communication, ability to navigate ambiguity, hands-on experience building FedRAMP-compliant service offering is a plus, familiarity with federal environments is a plus, understanding of AWS/GCP is a plus, relevant certifications are a plus, experience assessing AI is a plus, exposure to Kubernetes etc is a plus, strong interest in automation and willingness to share knowledge are valued). Some are "plus" but still content. We'll include them. Qualifications? The posting doesn't have a separate qualifications section; maybe we can combine with Requirements. But we need to follow rule: include a section only when posting has real specific content for it. There's no explicit "Qualifications" heading; we could omit Qualifications. Skills: maybe we can extract skills from requirements: GRC expertise, automation, cloud-native, etc. But we could also omit Skills if not explicit. Benefits: there is a Benefits paragraph with salary, equity, healthcare, FSA, flexible schedule, EAP, flexible time off, parental leave, monthly internet reimbursement, social events, remote work within US, hybrid option. That's benefits. Pay: The salary is included in benefits; but we could also create a Pay section if posting actually states them. The posting states "$150,000–$164,000 annual base salary". That's pay info. Should we create a Pay section? The rule: never create Pay/Schedule/Benefits sections unless posting actually states them. It does state salary, so we can create Pay section. However we also have Benefits section with other benefits. Could combine Pay into Benefits? But they said prefer a few substantive sections over many thin ones. Could merge Pay into Benefits? But they said include a section ONLY when posting has real specific content for it — never emit a heading followed by filler/placeholder text. If we put Pay section with salary, that's specific. Benefits section with other benefits. Could also have Schedule: posting mentions "Flexible work schedule." and "Remote work within the United States, with a hybrid option available from designated offices." That's schedule info. So we can create Schedule section. However we need to avoid duplication: flexible work schedule appears in Benefits as well. But we can still include Schedule section with that info. The rule: prefer a few substantive sections over many thin ones. Having Pay, Benefits, Schedule separate may be thin but each has specific content. Could combine Pay and Benefits into one Benefits section that includes salary and other benefits. That would be more substantive. The instruction: "Prefer a few substantive sections over many thin ones." So better to combine Pay and Benefits into a single Benefits section that includes salary, equity, healthcare, etc. Then we may not need a separate Pay section. Schedule: we could include schedule info within Benefits or separate? Could add a Schedule section for flexible work schedule and remote/hybrid. That's substantive enough. Let's decide: Sections: About the role, Responsibilities, Requirements, Benefits, Schedule. That's five sections. No Qualifications, Skills. We'll omit Skills as not explicit. Now we need to format: Use

for each section heading. Then content: For About the role: a paragraph(s) summarizing the description. Must preserve all substantive information; do not invent or summarize away detail. We need to keep all details but can rephrase? The instruction: "Preserve ALL substantive information; do NOT invent or summarize away detail." That suggests we should not omit details, but we can rephrase? It says do not summarize away detail; we should keep the details. Could we copy the original sentences? Probably okay to keep them as is, maybe split into paragraphs. We'll keep the substance. We need to remove boilerplate: cookie/navigation/legal/EEO/equal-opportunity/scam-warning, duplicated lines, application instructions. Also remove "This position is listed on behalf of a partner company, who manages all applications and next steps." That's maybe metadata but not boilerplate? It's about partner managing applications; could be considered minor metadata; we can fold into short

or drop it. The instruction: "Do NOT put Job ID / requisition numbers as headings — fold minor metadata into a short

or drop it." This line is about partner managing applications; maybe we can drop it as it's not substantive to role. But it's part of description; maybe we keep it as a short note. However it's not about the role itself; it's about application process. The instruction says remove application instructions. This line is about partner managing applications; could be considered application instructions. Safer to drop it. Also remove "Our partner is looking for a Staff Security Analyst - GRC based in United States." That's basically job title and location; we already have job title shown elsewhere; we should not repeat job title as heading. But we can keep location? Might be minor metadata; we could drop or keep in a short p. Probably drop. We need to keep all substantive info about role, responsibilities, requirements, benefits, schedule. Let's extract sections: About the role: The paragraph after the initial lines: "This is a senior-level role within an Information Security organization, focused on building and operating security and compliance programs at scale. You will lead commercial compliance initiatives across frameworks including SOC 1, SOC 2, ISO 27001, PCI-DSS, and HIPAA. The role combines GRC expertise with hands-on engineering and automation to make compliance processes more efficient and scalable. You will also contribute to federal compliance initiatives while helping expand public-sector security capabilities. Working across engineering, product, business, customers, auditors, and external suppliers, you’ll provide practical guidance that balances security requirements with business velocity. This position offers significant ownership in a fast-paced, cloud-native environment where automation, technical depth, and clear communication are highly valued." We'll keep that as About the role. Responsibilities: The list under "Accountabilities". We'll convert each sentence into

items. List: - Design, implement, and continuously monitor commercial security and compliance controls across environments supporting SOC 1, SOC 2, ISO 27001, PCI-DSS, and HIPAA requirements. - Partner with engineering teams to ensure systems and environments are appropriately scoped, secured, and aligned with applicable compliance obligations. - Develop and implement GRC engineering and automation solutions that scale compliance activities, automate control testing, and integrate continuous compliance checks into CI/CD pipelines. - Streamline compliance reporting and improve the efficiency and reliability of security and compliance processes through automation. - Support federal compliance initiatives involving frameworks and programs such as FedRAMP Moderate+, CMMC, DoD IL, FedRAMP 20x, and NIST 800-53. - Support customer trust activities by reviewing contracts for security and privacy requirements, completing detailed security questionnaires, and maintaining the customer trust portal. - Provide precise, actionable security and privacy guidance to engineering, product, and business teams, helping incorporate security and privacy by design. - Build and maintain effective relationships with external suppliers, auditors, assessors, and enterprise prospects. - Identify, track, and mitigate risks associated with compliance programs and projects while continuously monitoring supply chain security and vendor risk. - Clearly communicate security capabilities, controls, and compliance practices to enterprise customers and regulatory auditors. - Build new programs and initiatives from the ground up while managing multiple priorities in a complex, fast-moving environment. - Share knowledge and help junior colleagues develop their understanding of security, compliance, and automation practices. We'll put each as

. Requirements: The list under "Requirements". We'll convert each bullet into

. Note some are "plus" but still content. List: - 8–10+ years of relevant industry experience in security, compliance, GRC, or security program management. - Extensive experience with commercial security frameworks, regulations, and certifications, including ISO 27001, SOC 1, SOC 2, PCI-DSS, and HIPAA. - Experience working with GRC tools and building automation for security and compliance controls in cloud-native environments such as AWS, GCP, or Azure. - Working knowledge of or exposure to federal compliance frameworks including NIST 800-53, FedRAMP, and CMMC, with an interest in expanding federal compliance programs. - Strong cybersecurity knowledge and technical proficiency with enterprise SaaS applications and cloud infrastructure. - Strong project management and organizational skills, with the ability to manage multiple priorities and establish new programs. - Excellent written and verbal communication skills, with the ability to work effectively with both technical engineering teams and non-technical stakeholders. - Ability to navigate ambiguity, create clarity, and make sound decisions in complex and rapidly changing situations. - Hands-on experience building, delivering, or managing a FedRAMP-compliant service offering or achieving an Authority to Operate (ATO) is a plus. - Familiarity with federal and defense environments such as Platform One, Iron Bank, CMMC, or DoD IL is a plus. - Understanding of AWS or GCP environments and cloud configuration and management best practices is a plus. - Relevant certifications such as ISO 27001 Lead Implementer/Auditor, PCI QSA, CISA, CISSP, PMP, AWS/GCP Professional, or FedRAMP-specific credentials are a plus. - Experience assessing or applying AI in secure environments is a plus. - Exposure to Kubernetes, SBOMs, SLSA, and/or DLP is a plus. - A strong interest in automation and a willingness to share knowledge with junior team members are valued. We'll keep as is. Benefits: The paragraph under "Benefits". We'll include salary, equity, healthcare, FSA, flexible schedule, EAP, flexible time off and parental leave, monthly internet reimbursement, monthly/quarterly/annual social events, remote work within US, hybrid option. We need to preserve all details. Let's extract: "$150,000–$164,000 annual base salary, with compensation determined by location, level, relevant experience, and skills. Potential equity as part of the overall compensation package. Comprehensive healthcare benefits. Flexible Spending Account (FSA). Flexible work schedule. Employee Assistance Program (EAP). Flexible Time Off and parental leave. Monthly internet reimbursement. Monthly, quarterly, and annual social and team-building events. Remote work within the United States, with a hybrid option available from designated offices." We'll put each as

maybe, or as

with list. Since it's a list of benefits, we should use

• . We'll do that. Schedule: The posting mentions "Flexible work schedule." and "Remote work within the United States, with a hybrid option available from designated offices." That's schedule info. However we already included flexible work schedule and remote/hybrid in Benefits. To avoid duplication, maybe we should not duplicate. The rule: preserve ALL substantive information; do NOT invent or summarize away detail. If we include flexible work schedule and remote/hybrid only in Benefits, we still preserve them. So we may not need a separate Schedule section. But we could still have Schedule section that mentions those, but then we'd duplicate. Duplication is not prohibited explicitly but they said remove duplicated lines. So we should avoid duplicating the same content. So we should not repeat flexible work schedule and remote/hybrid in both Benefits and Schedule. So we can either put them in Benefits only, or Schedule only. Since Benefits already includes many items, we can keep schedule info there and not