Staff Security Analyst (Governance and Trust)

Location: Remote in the United States

Base salary: $151,000–$178,000 USD per year

Company

hirify.global provides hardened, secure, production-ready builds of open source software used by engineers and AI agents, helping organizations build faster, stay compliant, and reduce risk.

What you will do

• Run external examinations end to end, including evidence calendars, population and completeness-and-accuracy requests, sample fulfilment, auditor status calls, and readiness assessments for SOC 2, ISO 27001, Cyber Essentials, and additional certifications.
• Build working relationships with People, IT, Infrastructure, Engineering, Legal, and Sales to obtain evidence, manage populations, and deliver remediation.
• Own customer security diligence, including questionnaires, customer audits, Trust Center content, and multi-round assessments, while setting practical response expectations with Sales.
• Operate the third-party risk management program, including vendor intake, tiering, assessments, dispositions, and the register of critical suppliers and agreements.
• Act as product owner for customer-facing questionnaire responder and vendor-triage agents, maintaining the validated answer bank and judging output quality.
• Turn recurring diligence patterns into reusable artifacts, self-service packages, control improvements, remediation evidence, reporting, retrospectives, and cross-team actions; guide the public-sector compliance analyst and mentor the team.

Requirements

• Senior practitioner experience leading compliance and trust execution, including external examinations, customer security diligence, and third-party risk operations.
• Ability to work across a unified controls catalog, identify mapping and implementation defects, and produce remediation evidence that survives external re-testing.
• Ability to define requirements for evidence systems and AI-assisted questionnaire and vendor-triage workflows, validate their outputs, and maintain reliable answer banks.
• Ability to build cross-functional relationships and manage evidence, populations, remediation, reporting, retrospectives, and corrective actions across multiple teams.
• Ability to guide analysts, provide and receive feedback, manage work against metrics, and help build the team as it grows.
• Clear writing for auditors, customers, and executives, with sound judgment under examination pressure.
• Comfort working with customers and auditors across time zones and with US, UK, and European regulatory environments.

Nice to have

• Lead auditee-side experience for a combined SOC 2 Type 2 and ISO 27001 examination, including populations, sampling, completeness and accuracy, auditor relationships, and scope or control applicability discussions.
• Experience with regulated-industry diligence such as SIG, CAIQ, DORA-style questionnaires, portal-mediated assessments, and customer audits.
• High-volume vendor risk assessment experience and judgment on when to dispose or escalate findings.
• Experience using query-defined populations, identity, HR, and cloud evidence, and Git-managed policies and controls.
• Experience with corrective-action management systems and distinguishing completed actions from effective controls.
• US public-sector, UK, or EU compliance exposure, including FedRAMP, GovRAMP, CMMC, Cyber Essentials, UK GDPR, the EU Cyber Resilience Act, or DORA.
• Experience migrating from a GRC platform or building answer banks, trust packages, or response automation; familiarity with ISO/IEC 42001 or AI governance.
• Understanding of software supply chain security concepts such as SBOMs, signing, provenance, and SLSA.
• CISA, ISO 27001 Lead Auditor, ISO 27001 Lead Implementer, or equivalent certification.

Culture & Benefits

• Remote-first work with team meetups, bi-annual destination summits, and a monthly coworking, phone, and internet stipend.
• Stock options upon hire and promotion, with participation in secondary offerings and a 10-year exercise period.
• 100% coverage of health, vision, and dental insurance premiums for employees and dependents.
• Flexible time off and paid parental leave of 18 weeks for birthing parents and 12 weeks for non-birthing parents.
• Culture centered on customer focus, intentional action, transparency, trust, and assuming good intentions.