Security Transformation Senior Analyst

Role Summary

The Security Transformation Specialist supports enterprise vulnerability and compliance programs by translating security standards into measurable controls, developing and validating controls across cloud and on-premises environments, and driving remediation with business and technology stakeholders. The role serves as a technical subject-matter expert for vulnerability and compliance operations while contributing to automation, reporting, governance and continuous improvement.

Must-Have Skills

• Hands-on experience in cloud security and Cloud Security Posture Management (CSPM) platforms such as Wiz or Prisma Cloud.

• Strong expertise in Qualys Policy Compliance, including policy assessment, control validation and investigation of compliance findings.

• Good understanding of cloud-native security, operating-system-level security and security configuration standards.

• Working knowledge of AWS, Microsoft Azure and Google Cloud Platform (GCP).

• Solid networking and/or server administration knowledge, including the OSI model, encryption, common protocols, ports and network security concepts.

• Ability to interpret security standards and convert requirements into testable technical controls and scenarios.

• Excellent written and verbal communication skills, with the ability to explain technical findings to business and technology stakeholders.

• Strong collaboration skills and the ability to coordinate across geographically distributed, cross-functional teams.

Good-to-Have Skills

• Working knowledge of Python and/or shell scripting for automation, data handling and control validation.

• Experience with security-control development, cloud query languages, reporting and workflow automation.

• Relevant security certifications such as CCSP, CEH or CompTIA Security+.

Key Roles and Responsibilities

• Work with CSPM platforms and Qualys Policy Compliance to support control development, assessment and operational compliance activities.

• Interpret organizational security standards and translate requirements into control logic, test scenarios and measurable validation criteria.

• Develop, test and validate cloud-native and operating-system security controls before production deployment.

• Present new or enhanced controls in governance and review forums, clearly explaining the requirement, logic, test evidence, coverage and expected impact.

• Investigate false positives, approved variances, scan inaccuracies and control exceptions; document findings and coordinate corrective action.

• Partner with server, network, cloud, database and application teams to address vulnerabilities, configuration gaps and compliance findings.

• Provide remediation guidance and respond to stakeholder questions related to vulnerability patching and configuration changes required to align with organizational security standards.

• Act as a primary point of contact for vulnerability and compliance operational queries and coordinate issues through resolution.

• Conduct periodic reviews with business stakeholders covering risk posture, remediation progress, aging items, dependencies and blockers.

• Collaborate with tool vendors and internal platform teams to troubleshoot product issues, coverage gaps, scan failures and inaccurate findings.

• Facilitate discussions on security-control gaps and recommend practical remediation or control-enhancement options.

• Perform user acceptance testing for security-control enhancements using predefined scenarios and maintain clear evidence of results.

• Monitor assessment and scan coverage to help ensure in-scope infrastructure assets are evaluated according to the defined schedule.

• Prepare and maintain operational reports, dashboards, control evidence and governance records.

• Support governance and audit-readiness activities through regular reviews of processes, controls, evidence and operational performance.

• Identify opportunities to improve process efficiency, automate repeatable activities and strengthen the overall security posture.

• Perform authorized administrative and operational activities within security tools in accordance with documented procedures and access controls.

Technical Experience

• 4 -7 years of relevant experience in cybersecurity, vulnerability management, compliance operations, cloud security or security-control engineering.

• Practical experience with Qualys Policy Compliance and at least one CSPM platform, preferably Wiz or Prisma Cloud.

• Experience validating security controls across cloud platforms, servers, operating systems and network technologies.

• Exposure to issue tracking, evidence management, reporting and governance workflows.

Professional Competencies

• Analytical problem-solving and attention to detail.

• Ownership and accountability for assigned controls, findings and stakeholder commitments.

• Ability to prioritize work, manage dependencies and communicate risks or blockers promptly.

• Clear documentation, presentation and stakeholder-management skills.

• Continuous-improvement mindset with a focus on quality, consistency and measurable outcomes.