# Compliance Analyst **Company**: Cresta **Location**: United States (Remote) **Work arrangement**: remote **Experience**: senior **Job type**: full-time **Salary**: $160,000 – $180,000 **Category**: Engineering **Industry**: Technology **Apply**: https://job-boards.greenhouse.io/cresta/jobs/5013693008?utm_source=yubhub.co&utm_medium=jobs_feed&utm_campaign=apply **Canonical**: https://yubhub.co/jobs/job_5e465e33-ae2 ## Description Cresta is seeking a passionate individual with solid security engineering experience to support the security & compliance team and enable growing global data protection and cybersecurity efforts. Responsibilities: - Lead and manage all customer-facing security conversations, partnering cross-functionally to ensure timely resolution of issues and seamless execution of the security review lifecycle within sales deals. - Perform risk assessments to identify gaps, come up with recommendations, and drive the gaps to remediation. - Streamline and lead SOC 2 Type II, ISO 27001/27701/42001, PCI-DSS, TISAX, HIPAA, and FedRAMP audit processes. - Perform internal audits and keep the necessary documentation updated as required for audits. - Perform gap assessments against new regions and target industry markets to comply with compliance regulations as the company expands. - Conduct new-hire and annual security awareness training to educate personnel and re-iterate security and compliance requirements. - Oversee and continuously improve the vendor risk management framework, ensuring effective identification, assessment, and mitigation of third-party risks. - Establish metrics to track compliance program effectiveness and to report risk. - Interface with both technical (Engineering/Product) and non-technical (Sales/Marketing/Customer Success) teams. - Respond to customer RFIs, questions, audits and technical documentation requests. - Help build our common control framework and drive adoption of the framework within the organization. - Build and automate processes to achieve continuous compliance over the technology control environment. - Assist with sales and marketing materials representing product security and compliance. Qualifications We Value: - 4+ years of experience in security governance, IT audit, or security compliance management - 3+ years of program management, with experience in affecting technology decisions - End-to-end experience going through SOC 2 Type II, HITRUST, HIPAA, TISAX, ISO 27001/27701/42001, FedRAMP, and PCI-DSS external audits - Experience in a hands-on technical role, with basic understanding of software implementation and integration - Experience with cloud environments on AWS, GCP, Azure - A track record of building relationships and credibility with business leads, external partners, and regulators through collaborative and independent programs - Experience managing competing efforts and requirements - Experience with fast-growing cloud native SaaS start-ups - Bonus: Experience with building GRC engineering tooling - Bonus: Experience with AI security frameworks such as AIUC Perks & Benefits: - Comprehensive medical, dental, and vision coverage with plans to fit you and your family - Flexible PTO to take the time you need, when you need it - Paid parental leave for all new parents welcoming a new child - Retirement savings plan to help you plan for the future - Remote work setup budget to help you create a productive home office - Monthly wellness and communication stipend to keep you connected and balanced - In-office meal program and commuter benefits provided for onsite employees ## Skills ### Required - security governance - IT audit - security compliance management - program management - SOC 2 Type II - ISO 27001/27701/42001 - PCI-DSS - TISAX - HIPAA - FedRAMP - cloud environments ### Nice to have - building GRC engineering tooling - AI security frameworks such as AIUC --- Source: [Apply at job-boards.greenhouse.io](https://job-boards.greenhouse.io/cresta/jobs/5013693008?utm_source=yubhub.co&utm_medium=jobs_feed&utm_campaign=apply)