Information Security Operations Specialist

Quantifind•Palo Alto, CA

3d•$130,000 - $155,000•Hybrid

About The Position

As an Information Security Operations Specialist at Quantifind, you will be part of the Information Security Operations Team. This role involves supporting risk assessments of business and technical processes and systems within a fast-paced, Agile environment with regular compliance milestones. The position is located in Palo Alto, California, and operates within a hybrid work model combining remote work with in-office presence.

Requirements

Bachelor’s degree in a technical field.
3+ years of experience in a security compliance role.
Professional audit and/or information security certification (CISA, CISSP, CRISC, CISM).
Outstanding technical writing and verbal communication skills.
Great interpersonal skills for mapping between business and technical stakeholders.
Thorough understanding of IT security principles and procedures.
Professional experience evaluating the various risks and requisite controls associated with multi-tenant SaaS architectures.
Professional experience with SOC 2 or PCI controls and evidence submission to auditors.
Professional experience using NIST frameworks and ISO 27001.
Professional experience with Data Privacy compliance concepts and requirements including GDPR, CCPA, and CPRA.
Familiar with the risk assessment process from intake to completion.
Professional experience creating, reviewing and making necessary updates to technical security policies and procedures.
Professional experience interviewing technical subject matter experts to generate the content for responding to complex security compliance questionnaires.
Professional experience in technical writing about network architecture, including writing narratives and annotations.
Professional experience with customer and vendor management.
Conversant with evolving cybersecurity best practices.
Professional experience with formal SDLC and change control policies.
Must be legally authorized to work in the United States without the need for employer sponsorship, now or at any time in the future.

Nice To Haves

Experience with JIRA and Confluence is strongly preferred.
Familiarity with Drata or another security assurance platform is a plus.
Some exposure to CMMC and FISMA is a plus.
A team player who succeeds in a collaborative environment.
Able to work independently and can self-prioritize across multiple ongoing initiatives.

Responsibilities

Supporting risk assessments of business and technical processes and systems.
Converting subject matter expertise from Engineers and Data Scientists into technical content understandable by auditors.
Annotating diagrams showing Layer 2 switching and Layer 3 routing, network segmentation using VLANs, or secure data transfer and storage.
Adding to and maintaining an internal control environment to manage technology risk and comply with regulatory obligations.
Evaluating the various risks and requisite controls associated with multi-tenant SaaS architectures.
Managing evidence submission to auditors for SOC 2 or PCI controls.
Using NIST frameworks and ISO 27001.
Applying Data Privacy compliance concepts and requirements including GDPR, CCPA, and CPRA.
Managing the risk assessment process from intake to completion.
Creating, reviewing, and updating technical security policies and procedures.
Interviewing technical subject matter experts to generate content for responding to complex security compliance questionnaires.
Technical writing about network architecture, including writing narratives and annotations.
Managing customer and vendor relationships.
Staying conversant with evolving cybersecurity best practices.
Adhering to formal SDLC and change control policies.
Working with JIRA and Confluence.
Utilizing security assurance platforms like Drata.
Applying knowledge of CMMC and FISMA.
Collaborating within a team environment.
Working independently and self-prioritizing across multiple initiatives.