Description
Synack’s Penetration Testing as a Service platform manages customers’ attack surfaces by discovering new assets, pentesting for critical vulnerabilities and gaining visibility into the root causes of security risks. We are committed to making the world more secure by harnessing a talented, vetted community of security researchers to deliver continuous penetration testing and vulnerability management, with actionable results. Synack's PTaaS platform has uncovered more than 71,000 exploitable vulnerabilities to date, protecting a growing list of Global 2000 customers and U.S. agencies in a FedRAMP Moderate Authorized environment. For more information, please visit www.synack.com.
We are looking for a talented Information Security Compliance Manager with deep expertise in ISO, SOC, CMMC and FedRAMP compliance. You will work closely with the Product, Engineering, and Operations teams to ensure proper security controls and monitoring are applied. Sounds interesting? Keep reading…
**Please note that due to federal government contract requirements, we can only hire a citizen of the United States into this role.
Here’s what you'll do
- Automate generation of System Security Plans (SSP), including Security Concept of Operations, Risk Management Matrix, Security Control Traceability Matrix, and conduct Security Impact Analysis (SIA) on major system changes.
- Develop and maintain automated Plans of Action and Milestones (POAMs).
- Contribute to the adoption and implementation of automation and use of Artificial Intelligence (AI) within Synack's Information Security operations.
- Own the inventory and risk assessments of AI/agentic systems used across Synack, aligned to NIST AI RMF and ISO 42001, including data handling, model and agent change control, non-human identity and credential scoping.
- Build and own automated evidence collection and control-drift around security controls.
- Communicate regularly with stakeholders on security compliance issues aligning to CIS and NIST standards, track mitigation/remediation tasks, and assisting in generation of reports and metrics.
- Codify security controls into IaC guardrails, CNAPP policies, and CI/CD checks to prevent risks at commit and deploy time.
- Working with Project Managers and Software Engineers in a collaborative and enabling (non-obstructive) manner; Ensuring appropriate information security policies, standards, procedures, and guidelines are being incorporated across Synack hosted services and infrastructure, with a focus on hardening and adhering to DevSecOps principles.
- Coordinate with the field teams to respond to vendor security assessments and conduct 3rd party risk assessments of Synack vendors.
Here’s what you’ll need
- 8+ years of experience IT Security Strategy, Risk Management, IT Audit and Compliance with a Cloud Service Provider
- Experience with Python, Terraform, and CI/CD pipelines, plus comfort integrating tools with AI.
- Experience with Enterprise Governance, Risk Management, and Compliance (GRC) tools.
- Experience with event monitoring and alerting tools such as Datadog, Stackdriver, and Azure Sentinel.
- Experience with SOAR or auto-remediation platforms and detection engineering / SIEM query languages.
- Experience with Cloud Native Application Protection Platforms (CNAPP).
- Experience with leveraging security tools within the Software Development Lifecycle (SDLC).
- Familiarity with secrets management and workload identity (non-human).
- Working knowledge of security regulations, standards, and frameworks, including but not limited to ISO27000, ISO42001, OWASP, SOC2, GDPR, CMMC, FedRAMP, and NIST.
- Excellent written and verbal communication skills with the ability to accurately communicate security and risk-related information to technical and non-technical audiences.
Ready to join us?
Synack is committed to embracing diversity. Our people are our strength. Each addition to our team is an opportunity to grow and diversify our ideas, experiences, and viewpoints. Synack strives to be inclusive of all people.
As a candidate, Synack cares about your privacy. Please view our candidate privacy policy.
This position has responsibility to ensure Synack’s security and privacy posture is maintained.
$150,000 - $180,000 Salary is determined by a combination of factors including location, level, relevant experience, and skills. The range displayed on each job posting reflects the minimum and maximum target for new hire salaries for the position across all US locations. The compensation package for this position may also include equity, and benefits.
For more details about our benefits, please see our benefits overview. Then for the Employer code, enter: synack
Similar jobs
Est. 130,000 USD
Synack’s Penetration Testing as a Service platform manages customers’ attack surfaces by discovering new assets, pentesting for critical vulnerabilities and gaining visibility into the root causes of security risks. We a…
Est. 197,500 USD
Synack’s Penetration Testing as a Service platform manages customers’ attack surfaces by discovering new assets, pentesting for critical vulnerabilities and gaining visibility into the root causes of security risks. We a…
Est. 205,000 USD
Synack’s Penetration Testing as a Service platform manages customers’ attack surfaces by discovering new assets, pentesting for critical vulnerabilities and gaining visibility into the root causes of security risks. We a…
Est. 52,000 USD
Synack’s Penetration Testing as a Service platform manages customers’ attack surfaces by discovering new assets, pentesting for critical vulnerabilities and gaining visibility into the root causes of security risks. We a…
Est. 95,000 GBP
Synack’s Penetration Testing as a Service platform manages customers’ attack surfaces by discovering new assets, pentesting for critical vulnerabilities and gaining visibility into the root causes of security risks. We a…
Est. 185,000 USD
Synack’s Penetration Testing as a Service platform manages customers’ attack surfaces by discovering new assets, pentesting for critical vulnerabilities and gaining visibility into the root causes of security risks. We a…
Est. 170,000 USD
Synack’s Penetration Testing as a Service platform manages customers’ attack surfaces by discovering new assets, pentesting for critical vulnerabilities and gaining visibility into the root causes of security risks. We a…
Est. 300,000 USD
Synack’s Penetration Testing as a Service platform manages customers’ attack surfaces by discovering new assets, pentesting for critical vulnerabilities and gaining visibility into the root causes of security risks. We a…
Est. 300,000 USD
Synack’s Penetration Testing as a Service platform manages customers’ attack surfaces by discovering new assets, pentesting for critical vulnerabilities and gaining visibility into the root causes of security risks. We a…
Est. 315,000 USD
Synack’s Penetration Testing as a Service platform manages customers’ attack surfaces by discovering new assets, pentesting for critical vulnerabilities and gaining visibility into the root causes of security risks. We a…
Est. 173,500 USD
About SecurityScorecard: SecurityScorecard is the global leader in cybersecurity ratings, with over 12 million companies continuously rated, operating in 64 countries. Founded in 2013 by security and risk experts Dr. Ale…
Est. 173,500 USD
About SecurityScorecard: SecurityScorecard is the global leader in cybersecurity ratings, with over 12 million companies continuously rated, operating in 64 countries. Founded in 2013 by security and risk experts Dr. Ale…
Est. 92,500 USD
CyberSheath Services International LLC is a rapidly growing Security and IT Managed Services Provider primarily focused on providing Cybersecurity services to the Defense Industrial Base (DIB). We are excited to be expan…
Est. 120,000 USD
About Keyfactor Our mission is to securely connect the world: humans, machines, and AI. Keyfactor is the leader in trust infrastructure for AI and machines, helping the world's largest enterprises and government agencies…
Est. 160,000 USD
Founded in 2004, NetBrain is the leader in no-code network automation. Its ground-breaking Next-Gen platform provides IT operations teams with the ability to scale their hybrid multi-cloud connected networks by automatin…
About SecurityScorecard: SecurityScorecard is the global leader in cybersecurity ratings, with over 12 million companies continuously rated, operating in 64 countries. Founded in 2013 by security and risk experts Dr. Ale…
Est. 267,300 USD
We are seeking a highly technical Security Engineer to join our Product Security team. This role is integral to ensuring the security and integrity of our products and services. You will conduct in-depth code reviews, im…
About SecurityScorecard: SecurityScorecard is the global leader in cybersecurity ratings, with over 12 million companies continuously rated, operating in 64 countries. Founded in 2013 by security and risk experts Dr. Ale…
Est. 125,000 USD
About Us HSP Group is the premier provider of global expansion services, helping companies simplify the complex challenges of operating internationally. We deliver a seamless experience across legal entity setup, global…
Est. 60,000 EUR
About Us HSP Group is the premier provider of global expansion services, helping companies simplify the complex challenges of operating internationally. We deliver a seamless experience across legal entity setup, global…
Est. 115,000 USD
About 10a Labs: 10a Labs is the safety and threat-intelligence layer trusted by frontier AI labs, AI unicorns, Fortune 10 companies, and leading global technology platforms. Our adversarial red teaming, model evaluations…
Est. 231,300 USD
Scale has been the leading AI data foundry, helping fuel the most exciting advancements in AI, including frontier model training, enterprise adoption, defense applications, and autonomous vehicles. Our mission is to deve…
Est. 240,300 USD
Scale is powering the generative AI wave by providing the data and infrastructure for companies to build large-scale foundation models. AI is rapidly changing the world, and Scale is growing to meet that rapid demand acr…
Est. 210,500 USD
Company Background Censys’ mission is to be the one place to understand everything on the internet. Frustrated by the lack of trustworthy Internet intelligence, we set out to create the industry’s most comprehensive, acc…
Est. 205,000 USD
At OpenSpace, we’re redefining how the world’s most complex projects are built. Our AI-powered Visual Intelligence Platform uses computer vision and spatial AI to give construction teams a real-time view of what’s happen…
Est. 157,500 USD
We are seeking an Associate Director, Security & Compliance to lead security, privacy, and compliance for our SaaS products and the client projects we deliver as an agency. You will own this capability end to end, fr…
About SecurityScorecard: SecurityScorecard is the global leader in cybersecurity ratings, with over 12 million companies continuously rated, operating in 64 countries. Founded in 2013 by security and risk experts Dr. Ale…
Est. 92,500 USD
Company Overview Metrea delivers effects-as-a-service to national security partners across five domains and more than a dozen mission areas. These include airborne ISR, electronic warfare, secure communications, aerial r…
About SecurityScorecard: SecurityScorecard is the global leader in cybersecurity ratings, with over 12 million companies continuously rated, operating in 64 countries. Founded in 2013 by security and risk experts Dr. Ale…
About SecurityScorecard: SecurityScorecard is the global leader in cybersecurity ratings, with over 12 million companies continuously rated, operating in 64 countries. Founded in 2013 by security and risk experts Dr. Ale…