Security Assurance Analyst - USDS

About the Team

The Validation and Verification (VnV) team ensures the security and reliability of our product through a comprehensive, continuous security lifecycle: Prevent → Assure → Test → Fix → Prove.

The Security Operations Assurance (SOA) team is the vital link between identifying security flaws (Test) and demonstrating risk reduction (Prove). We own the Assure and Fix stages. Our Security Assurance Analysts focus primarily on the Assure stage by validating control efficacy, developing security metrics, and managing the tooling infrastructure that provides real-time visibility into our security posture.



Working alongside the Vulnerability and Remediation Analysts, you will be the data and assurance expert, ensuring we have the reliable metrics needed to monitor, report on, and ultimately Prove the effectiveness of our security investments.



About the Role

The Security Assurance Analyst is a highly technical role within the SOA team, focused on the operational health and measurable efficacy of our security controls. You are responsible for designing, building, and maintaining the systems that allow us to confidently say our defenses are working.



You will be the key driver in creating and updating the real-time operational dashboard, gathering and normalizing data from various security tools (EDR, CSPM, scanners), and supporting the Team Lead in creating the high-level risk reports. This role requires a strong understanding of security tools, data analysis, and an ability to translate raw operational data into meaningful security metrics (KPIs/KRIs).



Responsibilities:

- Security Metrics and Reporting: Design, develop, and maintain the central security metrics and executive risk reporting data pipeline, ensuring data integrity and accuracy.

- Operational Dashboard Management: Build and continuously update the real-time operational dashboard that provides visibility into security tool status, asset coverage, and control efficacy.

- Security Control Efficacy Validation: Conduct regular checks and operational audits on critical security controls to verify they are deployed correctly, functioning as intended, and effectively mitigating threats (Assure stage).

- Tools Health Monitoring: Monitor the operational status and health of various security tools (e.g., ensuring agents are deployed and checking in, scanners are running successfully).

- Data Aggregation and Normalization: Gather and normalize data inputs from disparate security tools and systems to support unified metrics calculation and reporting.

- Compliance Support: Assist the Team Lead in preparing data packages and evidence for internal and external security audits and compliance reviews (Prove stage).

- Process Improvement: Identify and recommend improvements to the processes used for collecting security data and verifying control effectiveness.