Saviynt’s Enterprise Identity Cloud helps modern enterprises scale cloud initiatives and solve the toughest security and compliance challenges in record time. The company brings together identity governance (IGA), granular application access, cloud security, and privileged access (PAM) to secure the entire business ecosystem and provide a frictionless user experience. The world’s largest brands trust Saviynt to accelerate digital transformation, empower distributed workforces, and meet continuous compliance.
The Distinguished Security Engineer, Information Security, reports into Information Security leadership, and will lead various Technical and Governance, Risk and Compliance (GRC) efforts as they relate primarily to the FedRAMP Program.
The candidate will possess the ability to execute, scale, and continuously evolve the InfoSec and GRC functions to maximize the impact and oversight across the organization. The candidate must be comfortable managing projects in an Agile environment.
The candidate should be familiar with policy and compliance requirements, including policy documentation and system requirements to successfully respond to potential audits.
1. Prior experience working as a hands on Security Architect or Engineer. Solid understanding of cloud (AWS, Azure), containers and Kubernetes environments, and applications
2. Lead the evaluation and integration of security technologies, ensuring scalability, resilience, and compliance. as it pertains to FedRAMP environments
3. At least Senior Engineer level experience and practical hands-on working knowledge of secure solutions for cloud (AWS, Azure), containers and Kubernetes environments and applications
4. Ability to independently run vulnerability scans, triage results, establish exploitability of reported vulnerabilities, recommend risk mitigation controls, and deploy controls where needed
5. Ability to recommend monitoring enhancements needed, and evaluate detection alerts at a high level

WHAT YOU WILL BE DOING

• Serve as the lead for Saviynt’s FedRAMP Info Sec and Compliance related activities
• Taking Saviynt through FedRAMP certification and re-recertification journey
• Develop System Security Plans (SSP), drive FedRAMP audit work with support from cross functional team members
• Lead monthly ConMon discussions, especially the technical aspects
• Review security documentation/artifacts such as audit reports, gap analysis reports, POA&Ms, etc.
• Serve as the Governance POC both internally and externally.
• Identify governance or compliance requirements, assess risks, review required forms
• Serve as liaison across cross functional teams to help achieve Info Sec objectives. Proactively work with cross functional peers to establish InfoSec requirements and expectations, so that compliance checks provide assurance for implemented controls
• Accountable for the execution of various compliance assessments throughout the year, primarily FedRAMP related audits. Ability to extend to other audits such as ISO 27001, PCI-DSS, SOC 1, SOC 2 is a plus
• Draft and update key security documentation including policies, guidance documents, Contingency Plan, Incident Response Plan, etc.
• Help automate GRC inefficiencies through automation and improved workflows.
• Perform vulnerability scanning and provide remediation guidance as needed.
• Have a working knowledge of the NIST CSF and RMF frameworks
• Support customer requests as they pertain to Compliance queries and to other Information Security questions, with the support of technical Info Sec members
• Develop and update Policies, Standards and Procedures per the organization’s policy framework
• Establish and lead risk management activities, including identification of risk and recommended mitigations; track and manage risks and issues from identification through closure.
• Establish and maintain appropriate metrics that will help measure the GRC posture of the company
• Collaborate with key stakeholders to ensure successful execution of mission and business needs
• Execute on GRC initiatives as defined within the security roadmap, while working with the broader Information Security team and technology teams
• Conduct risk assessments, compile risk registers, and track risk remediation plans
• Respond to requests from customers for information on our security measures
• Completing vendor security reviews. Optimize and automate the security questionnaire process.
• Review security clauses in customer and vendor contracts
• Establish, review, and enhance security training and awareness programs
• Support the business with customer engagements, including attending customer calls and supporting sales teams

If required for this role, you will:

• Complete security & privacy literacy and awareness training during onboarding and annually thereafter
• Review (initially and annually thereafter), understand, and adhere to Information Security/Privacy Policies and Procedures such as (but not limited to)