Senior Security & Compliance Analyst

Are you passionate about shaping the future of information security in a dynamic, high-growth environment? As a Senior Security GRC Analyst at Navan, you'll take the lead in driving compliance with key security standards and frameworks. You'll spearhead efforts to achieve crucial certifications and attestations, all while collaborating with diverse business stakeholders to design and implement robust security controls. Your influence will span the entire organization as you work to continuously enhance Navan’s security posture and provide assurance to our customers. If you're someone who thrives on making a tangible impact and adapting quickly to change, we invite you to join our team and help drive our mission forward.

What You’ll Do:

• Collaborate with Cross-Functional Teams: Work closely with teams such as HR, Finance, and Legal to identify control gaps and integrate control requirements.
• Engage in Compliance Activities: Partner with product engineering and other teams on compliance matters, external audit engagements, and assessments.
• Conduct Assessments and Testing: Perform periodic assessments and testing of all applicable security compliance controls, policies, and standards.
• Drive Security Program Maturity: Contribute to the improvement of the overall cybersecurity program's maturity.
• Lead Internal Security Assessments: Oversee internal security assessment walkthroughs and collect evidence for external audits.
• Execute External Audit Activities: Lead the execution of external audits over Navan’s products and internal controls in accordance with frameworks like SOC 1, SOC 2, PCI DSS, ISO 27001, and NIST CSF.
• Develop Metrics and Reporting: Create metrics and reports to demonstrate compliance status and progress.
• Automate Controls and Processes: Drive automation of controls and process improvements within the compliance portfolio.
• Facilitate Remediation Efforts: Work with the security team on assessment findings and oversee remediation efforts.
• Provide Guidance and Consultation: Offer ongoing advice to promote a sustainable security and compliance program.
• Implement GRC Tools: Collaborate on developing and implementing a centralized audit evidence repository and GRC tools.
• Stay Updated with Regulatory Changes: Integrate changes to laws, regulations, and frameworks into daily activities.

What We’re Looking For:

• Experience: 5+ years of security governance, risk, and compliance experience with programs complying with certifications like PCI DSS, ISO 27001, SOC 1, and SOC 2.
• Expert Knowledge: In-depth understanding of PCI DSS, GDPR, ISO 27001, SOC frameworks, and relevant regulations.
• Cloud Expertise: Strong knowledge of cloud controls and environments, particularly AWS.
• Technical Proficiency: Practical understanding of IT security compliance, risk management, access control, network security, security architecture, and operations in a cloud environment.
• Analytical Skills: Excellent analytical, diagnostic, critical thinking, and project management abilities.
• Communication Skills: Ability to communicate effectively with diverse technical and cultural backgrounds.
• Data Presentation: Proficiency in representing data graphically.
• Engagement Skills: Strong skills in engaging both internal and external stakeholders.
• Policy Development: Experience in creating security policies, procedures, and standards.
• Certifications (Preferred): CISA, CISM, CISSP, CSA CCSK, ISC² CCSP, or other relevant security certifications.
• Additional Qualifications (Plus):
• Experience with Big Four consulting firms.
• Experience with developing and implementing unified control frameworks.

The posted pay range represents the anticipated low and high end of the compensation for this position and is subject to change based on business need. To determine a successful candidate’s starting pay, we carefully consider a variety of factors, including primary work location, an evaluation of the candidate’s skills and experience, market demands, and internal parity.

For roles with on-target-earnings (OTE), the pay range includes both base salary and target incentive compensation. Target incentive compensation for some roles may include a ramping draw period. Compensation is higher for those who exceed targets. Candidates may receive more information from the recruiter.