Cybersecurity Analyst - Commercial Compliance

About this role

<div class="content-intro"><p>Armis, <strong>the cyber exposure management & security company</strong>, protects the entire attack surface and manages an organization’s cyber risk exposure in real time. In a rapidly evolving, perimeter-less world, Armis ensures that organizations continuously <strong>see</strong>, <strong>protect</strong> and <strong>manage</strong> all critical assets - from the<strong> ground to the cloud</strong>. Armis secures Fortune 100, 200 and 500 companies as well as national governments, state and local entities to help keep critical infrastructure, economies and society stay safe and secure 24/7.</p> <p>Armis is a privately held company headquartered in California.</p></div><div id="external-jobs-show-description" class="external-panel__trix-content external-panel__trix-content--colored external-panel__trix-content--lead-in"> <div id="External::Careerspage::Renderrichtrixcontent-react-component-8922e816-ee68-4475-8dfc-0f449612cbd5"> <p>As Armis rapidly scales its operations, we are seeking a motivated Cybersecurity Analyst to join our Governance, Risk and Compliance team and directly support our commercial compliance efforts. This role will be an integral part of maintaining and strengthening our overall security posture. You will focus on the foundational work of security, assisting our team in gathering essential evidence, documenting control implementation across our platforms, and ensuring the smooth operation of our key security processes. <br><br>You will collaborate closely with various departments and end-users across the company, primarily supporting the vital functions of the Office of the Chief Information Security Officer (OCISO) team.<br><br><strong>What you'll do:</strong></p> <ul> <li><strong>Audit and Assessment Support:</strong> Provide direct support for external and internal audit efforts, specifically focusing on frameworks such as SOC 2 Type 2, ISO 27001, ISO 27017, ISO 27018,  and ISO 42001. </li> <li><strong>Evidence Management & Monitoring:</strong> Execute and document procedures for continuous monitoring and evidence gathering. You will also implement automated solutions, including utilizing AI, to effectively reduce manual efforts associated with repetitive evidence collection tasks, ensuring security artifacts are accurately captured and readily available.</li> <li><strong>Policy and Documentation:</strong> Review, edit and update internal security policies, standards and procedures to ensure they accurately reflect current operational controls and compliance requirements.</li> <li><strong>Vendor and Supply Chain Risk Management (SCRM):</strong> Assist in the supply chain risk management program by tracking vendor compliance documentation, reviewing vendor security posture, and maintaining the vendor risk register.</li> <li><strong>Risk and Sales Support:</strong> Participate in internal security audits and support the business development team by completing security questionnaires for Requests for Proposal (RFP), ensuring accurate and compliant representation of our controls.</li> </ul> <p> </p> <p><strong>What we expect</strong></p> <ul> <li>5+ years of experience in a security, IT audit, GRC or related technical field.</li> <li>Bachelor's degree in Cybersecurity, Information Technology, Computer Science, or a related field; equivalent professional experience will be considered in lieu of a degree.</li> <li>Maintain industry certifications such as CompTIA Security+ and work toward advanced certifications such as (ISC)² CISSP.</li> <li>Foundational understanding of diverse regulatory environments and major security frameworks and compliance standards (e.g., ISO, SOC, HIPAA, SOX, NIST, FedRAMP, GovRAMP, DoD IL 5/6 PCI DSS).</li> <li>Foundational understanding of enterprise IT and OT/ICS environments, including network protocols, operating systems, cloud platforms and security technologies.</li> <li>Foundational understanding of core cloud technologies, particularly security concepts and services within AWS and GCP.</li> <li>Strong organizational skills, exceptional attention to detail, and the ability to manage documentation effectively.</li> <li>Excellent written communication skills, with experience reviewing and editing formal technical documents and policies.</li> </ul> <p> </p> <p><strong>Preferred Skills</strong></p> <ul> <li>Prior experience in directly supporting security audits for the frameworks noted above.</li> <li>Familiarity with the FedRAMP authorization process and compliance requirements.</li> <li>Detailed understanding of core security concepts, including data encryption, logical access controls, and boundary security mechanisms.</li> <li>Working experience with Linux operating systems.</li> <li>Experience supporting security or compliance efforts in AWS and GCP cloud environments.</li> <li>Experience working with a global team where the majority of team members are remote.</li> <li>Experience working with task planning tools like JIRA and Asana.</li> <li>Experience managing content throughout its lifecycle in the Microsoft Office 365 and Google Workspace ecosystems.</li> <li>Experience using GRC automation and evidence management platforms such as Anecdotes, Drata, or similar tools to streamline…