Security Compliance Specialist II
Remote
Applications have closed
Civis Analytics
Data solutions that deliver messages to your audiences and turn your data into successful campaigns. Make smarter, faster decisions that drive real results.What we do
Civis Analytics, Inc. helps leading businesses, nonprofits, and governments use data to identify, attract, and engage customers, constituents, and citizens. With a blend of proprietary data, technology, and advisory services, and an interdisciplinary team of data scientists, developers, and survey science experts, Civis helps organizations stop guessing and start using statistical proof to guide decisions. Learn more about Civis at www.civisanalytics.com.
Our mission
Our mission is to bring objective, data-driven truth to organizational decision-making – all the way from the boardroom to the world’s largest social causes.
What we are looking for
Civis is seeking a Security Compliance Specialist II to join the Civis Information Security Team. This position will work with the Director of Information Security to support compliance, risk management, and data governance activities across the business to meet key security program milestones and cost objectives.
As a Security Compliance Specialist II, you will be responsible for Civis’s SOC2 and FedRAMP compliance, embedded across discrete business units, to ensure compliance objectives are met throughout the process, product development lifecycle, and service delivery.
We are looking for an individual who is passionate about compliance and possesses both a broad control framework understanding and the technical acumen to enable a hands-on approach in guiding security best practices across engineering teams. An ideal candidate would bring with them expertise in creative problem solving, the ability to work on multiple tasks in parallel, and ability to manage expectations in a fast-paced environment, all while maintaining a high quality of work.
Responsibilities
- Conduct compliance assessments of controls for in-scope systems, including remediation assessments and audit-readiness assessments.
- Provide subject-matter expertise on SOC2/FedRAMP requirements and partner with technical teams to execute and monitor controls related to compliance initiatives.
- Identify control deficiencies and maintain records of deficiency details, including management response documentation and exposure check evidence.
- Drive remediation activities with stakeholders, including developing remediation plans, tracking, and reporting remediation progress.
- Work with incident response (IR) team members as a communication commander to gather forensic evidence for investigations and remediation.
- Perform continuous monitoring activities and track control health metrics.
- Support evidence collection/documentation and lead efforts related to internal and external audits, including FedRAMP/SOC2 Assessments.
- Maintain FedRAMP Authorization package, including the System Security Plan (SSP), Plan of Action & Milestones (POA&M), and other associated documentation.
- Participate in Continuous Monitoring (ConMon) program and interface with FedRAMP customers and the FedRAMP PMO.
- Perform continuous security audit, report findings and provide recommendations to the Director of Information Security.
Required Qualifications
- Demonstrated FedRAMP Ready/ATO, SOC 2, NIST 800-53, NIST CSF assessment experience.
- 3+ years of work experience with at least 2 years in security, with demonstrated accomplishment in assessments and controls.
- Minimum one year of hands-on, practical experience in one or more security domains, e.g., Application, Cloud, Network.
- Project management experience.
- Ability to stay up to date and proactively informed on developing regulatory concerns and evolving compliance control solutions.
- Excellence in documentation of policies, procedures, and guidelines.
- Strong problem-solving and process improvement skills.
- Excellent verbal and written communication skills.
Preferred Qualifications
- Hold any of the relevant certifications (CISSP, CISM, CISA, ISA, CIS, etc.).
- Knowledge and experience working with Cloud technologies/environments, AWS, Azure, GCP or other related cloud experience.
- Proficiency with Atlassian products Jira and Confluence.
- Experience performing vendor due diligence.
- Experience with performing risk analysis for systems, processes, third-party tools/applications and configurations.
Who we are
At Civis, we have opportunities for applicants who are newcomers, seasoned professionals, and anywhere in between. Our teams are energized by complex challenges and value diversity of thought. Opportunities to stand out and inspire happen daily and we trust and encourage you to act on your ideas – no matter how big they are. We offer you the tools and community you need to do your best work. Each of us is committed to holding ourselves accountable for results, challenging the status quo and finding new ways to grow our company and each other.
Why join our team?
- The opportunity to be part of a growing tech startup focused on solving interesting and meaningful problems, invested in internal promotion, and committed to fostering a diverse, equal and inclusive workplace.
- Competitive benefits, including unlimited PTO, 401K match with immediate vesting, health, dental, and vision benefits, fully paid parental leave, breastfeeding support including breastmilk shipping services for traveling moms, commuter benefits, wellness initiatives including weekly group meditations, monthly on-site massage therapy, and pet insurance.
- To support employees in our now fully remote work environment, we also have expanded our virtual journal and book clubs, Donut Pals (organized virtual coffee meet-ups), Lightning Talks (5-minute presentations on anything you’d like), Lunch-and-Learns, and HR Open Discussions (bi-weekly meet-up where we discuss ideas and topics of the day in a casual format). We are also able to support and accommodate flexible work from home schedules to help employees juggle responsibilities at home.
Civis Analytics embraces the individuality of our employees and we celebrate each other's differences. Our products, services, and culture benefit from and thrive on the unique perspectives brought by each person in our community. We're proud to be an equal opportunity workplace, and we are committed to equal employment opportunity regardless of race, age, sex, color, ancestry, religion, national origin, sexual orientation, gender identity, citizenship, marital status, disability, or Veteran status. If you have a disability or special need that requires accommodation, please contact internalrecruiting@civisanalytics.com
In compliance with federal law, all persons hired will be required to verify identity and eligibility to work in the United States.
Tags: Analytics Audits AWS Azure CISA CISM CISSP Cloud Compliance FedRAMP GCP Governance Incident response Jira Monitoring NIST Risk analysis Risk management SOC SOC 2 System Security Plan
Perks/benefits: 401(k) matching Career development Competitive pay Flex hours Flex vacation Health care Insurance Parental leave Startup environment Unlimited paid time off Wellness
More jobs like this
Explore more InfoSec / Cybersecurity career opportunities
Find even more open roles in Ethical Hacking, Pen Testing, Security Engineering, Threat Research, Vulnerability Management, Cryptography, Digital Forensics and Cyber Security in general - ordered by popularity of job title or skills, toolset and products used - below.
- Open Ethical hacker / Pentester H/F jobs
- Open Information Security Specialist jobs
- Open Senior Cyber Security Engineer jobs
- Open Manager Pentest H/F jobs
- Open Cyber Security Architect jobs
- Open Cyber Security Specialist jobs
- Open Product Security Engineer jobs
- Open Information Systems Security Officer (ISSO) jobs
- Open Principal Security Engineer jobs
- Open Staff Security Engineer jobs
- Open Senior Information Security Analyst jobs
- Open Cybersecurity Analyst jobs
- Open Consultant infrastructure sécurité H/F jobs
- Open IT Security Analyst jobs
- Open Chief Information Security Officer jobs
- Open Consultant SOC / CERT H/F jobs
- Open Cybersecurity Consultant jobs
- Open Senior Information Security Engineer jobs
- Open Security Specialist jobs
- Open Cybersecurity Specialist jobs
- Open Senior Penetration Tester jobs
- Open Security Researcher jobs
- Open Sr. Security Engineer jobs
- Open Senior Security Architect jobs
- Open Security Operations Analyst jobs
- Open Clearance-related jobs
- Open ISO 27001-related jobs
- Open Windows-related jobs
- Open Network security-related jobs
- Open Application security-related jobs
- Open Agile-related jobs
- Open Pentesting-related jobs
- Open Vulnerability management-related jobs
- Open GCP-related jobs
- Open SaaS-related jobs
- Open Analytics-related jobs
- Open CISA-related jobs
- Open IAM-related jobs
- Open Threat intelligence-related jobs
- Open APIs-related jobs
- Open Security assessment-related jobs
- Open Java-related jobs
- Open IDS-related jobs
- Open DevOps-related jobs
- Open Security Clearance-related jobs
- Open Malware-related jobs
- Open EDR-related jobs
- Open Kubernetes-related jobs
- Open CEH-related jobs
- Open IPS-related jobs