Security Compliance Analyst

Sumo Logic is seeking a Security Compliance Analyst to support existing compliance initiatives and audits for its fast-growing Cloud Based SaaS Company. The role involves designing and maintaining internal controls, performing security reviews, leading 3rd party risk assessments, and developing security documentation. The ideal candidate will have experience in a SaaS environment and with compliance frameworks like PCI-DSS, SOC2, HIPAA, ISO27001, and FedRAMP, demonstrating strong communication and organizational skills.

Must Have

• Design, develop, and maintain internal controls for FedRAMP, SOC2, HIPAA, PCI-DSS, ISO27001.
• Perform security reviews and identify security gaps.
• Support tooling and automation for security and compliance activities.
• Lead planning, coordination, and execution of 3rd party risk assessments and audits.
• Develop and maintain internal and external-facing security and compliance documentation.
• Work with product and engineering teams to maintain compliance baseline.
• Formulate processes in line with compliance and security controls and manage risk treatment.
• Provide direction to management team on compliance goals and statuses.
• Drive periodic reviews, updates, and maintenance of compliance items.
• Interface with external auditors and be a primary point of contact.
• Participate in maintenance of standard security and compliance collateral.
• Support the analysis, classification, and response to cybersecurity risks.
• Support sales team with customer meetings regarding Information Security and Privacy.
• Strong skills in Communication, Security and Privacy, and Compliance of security controls.
• Ability to work and communicate across various teams and levels of the business.
• Knowledge of compliance frameworks such as PCI DSS, ISO 27001, SOC 2, IRAP and NIST 800-53 / FedRAMP.
• Must be authorized to work in the United States.

Good to Have

• B.S. in Computer Science / Computer Security or related discipline.
• Cybersecurity Licenses and/or Certifications (e.g., CRISC, CISM, CISSP).
• Experience working with Sales Teams.
• Experience in public cloud environments.
• Incident response experience or training.
• Assist with managing penetration testing, code reviews, internal scanning and remediation of findings.
• Performs internal audit of key controls and communicate results to the executive team.

Security Compliance Analyst

You will get the opportunity to be on the cutting edge of Cloud Security and Compliance. Sumo Logic is looking for a Security and Compliance Analyst who will be responsible for supporting existing compliance initiatives and continued audits for a fast growing, highly technical Cloud Based SaaS Company.

The ideal candidate will have supported compliance programs in a SaaS environment. The role requires you to be detail oriented and highly organized. The ability to take ownership of cross-functional projects and complete them on time and on budget will be crucial to fuel your personal and Sumo Logic’s growth.

This role is critical to Sumo Logic and will collaborate with our DevSecOps Automation and Security Operations Team as well as all lines of business at Sumo Logic to build relationships and trust across the organization. This role is also critical in representing the Sumo Logic Security Compliance vision to our rapidly expanding global enterprise customer base in the new frontier of cloud computing.

The ideal candidate will have supported security compliance programs and experience in a SaaS environment. Additionally, this candidate must have experience with 2 of the following: PCI-DSS, SOC2, HIPAA, ISO27001, and FedRAMP. Communication skills are critical to success. The role requires you to be detail oriented and highly organized with a positive attitude under pressure. The ability to take ownership of cross-functional projects and complete them on time and on budget will be crucial to fuel your personal and Sumo Logic's growth.

Responsibilities

• Design, develop, and maintain internal controls in response to security and compliance goals: FedRAMP, SOC2, HIPAA, PCI-DSS, ISO27001, etc.
• Perform security reviews and identify security gaps in architecture resulting in recommendations for inclusion in the risk mitigation strategy
• Support tooling and automation that facilitate security and compliance related activities and lead to reducing the disruption of audit events
• Lead planning, coordination and execution of 3rd party-risk assessments and audits
• Develop and maintain internal and external-facing security and compliance documentation
• Work with product and engineering teams to maintain compliance baseline in Sumo Logic products
• Work with internal teams to formulate processes in line with compliance and security controls, hold them accountable for following them, and manage throughout Risk Treatment and Remediation plans
• Provide direction to management team on compliance goals and statuses
• Drive periodic reviews, updates, and maintenance of compliance items
• Interface with external auditors and be a primary point of contact for audits
• Participate in maintenance of standard security and compliance collateral for marketing and sales activities

Required Qualifications and Skills

• The role needs to be located primarily in the US
• Support the analysis, classification, and response to cybersecurity risks within the organization
• Support sales team with customer meetings regarding questions on Information Security and Privacy
• Must have strong skills in the following areas: Communication, Security and Privacy and the Compliance of security controls.
• Ability to work and communicate across various teams and at various levels of the business is essential to this role.
• Knowledge of compliance frameworks such as PCI DSS, ISO 27001, SOC 2, IRAP and NIST 800-53 / FedRAMP.

Desired Qualifications and Skills

• B.S. in Computer Science / Computer Security or related discipline
• Cybersecurity Licenses and/or Certifications (e.g. Certified in Risk and Information Systems Control™ (CRISC, Certified Information Security Manager® (CISM), Certified Information Systems Security Professional (CISSP), or equivalent).
• Experience working with Sales Teams
• Experience in public cloud environments
• Incident response experience or training
• Assist with managing penetration testing, code reviews, internal scanning and remediation of findings
• Performs internal audit of key controls and communicate results to the executive team