Sr. Cyber Assurance Analyst at SpaceX

Redmond, Washington, United States -

Full Time

Start Date

Immediate

Expiry Date

06 Apr, 26

Salary

175000.0

Posted On

06 Jan, 26

Experience

5 year(s) or above

Remote Job

Yes

Telecommute

Yes

Sponsor Visa

Skills

Cybersecurity Compliance, Security Audits, Technical Security, Control Testing, Risk Management, Security Frameworks, Communication Skills, Project Management, Vulnerability Scanners, Security Tooling, Third-Party Risk Management, Mentoring, Process Improvement, Documentation, Emerging Trends, Technical Evidence Gathering

Industry

Aviation and Aerospace Component Manufacturing

Description

SpaceX was founded under the belief that a future where humanity is out exploring the stars is fundamentally more exciting than one where we are not. Today SpaceX is actively developing the technologies to make this possible, with the ultimate goal of enabling human life on Mars. SR. CYBER ASSURANCE ANALYST Cyber Assurance is the practice of providing confidence that systems, products and processes meet security, regulatory and compliance obligations. It bridges governance with technical execution – validating that controls are in place, risks are managed, and requirements are met for both internal and customer-facing systems. As a teammate you will operate within the Information Assurance, working closely with engineers to understand systems, how controls are implemented, be hands-on with collecting and reviewing evidence, driving efficiencies and remediation efforts, along with providing technical support for Enterprise and Launch systems. As an ideal candidate, you love living at the intersection of security, compliance, and emerging technology. You thrive on rolling up your sleeves to dig into configs, logs, and making sense of challenging complex or ambiguous requirements. You’re comfortable explaining security frameworks and security best practices to non-technical teams as you are at grabbing a hash of a file or identifying an insecure default configuration. You are firm when it matters but also flexible to consider alternative ways to move the ball forward. You excel at handling concurrent complex efforts and flourish in an environment where learning never ceases, where the breadth of operations ranges from rockets to routing tables, and where teams are laser-focused on mission accomplishment -- excitement guaranteed! RESPONSIBILITIES: Lead and support security audits and certification (NIST 800-171, NIST 800-53, ISO 27001, etc.) efforts Partner with engineers to gather and validate technical evidence (configs, code snippets, logs, system designs, etc) Perform technical security and risk assessments of systems and networks within our environment and identify where they deviate from security policy, standards or regulations Identify security control/ compliance gaps, advise on remediation, and drive timely resolution with engineers Maintain necessary documentation of controls, processes and audits Identify and drive assessments and audit efficiency through system integration, data utilization, and process improvement Support third-party risk management efforts including supplier onboarding and periodic cyber assessments Identify and propose business enabling actions by maintaining an up-to-date understanding of emerging trends in information security risks, changes in standards, and new compliance/assurance techniques and trends Mentor fellow teammates and take an active role in their development BASIC QUALIFICATIONS: High school diploma or equivalency certificate 5+ years of experience (can be concurrent) in cybersecurity compliance, audit or technical security roles with strong knowledge in security compliance frameworks (e.g. NIST 800-53, NIST 800-171, ISO 27001) 5+ years of experience (can be concurrent) with control testing, security standards/policy development, security audits, or security risk management PREFERRED SKILLS AND EXPERIENCE: Ability to interpret code/ configurations and analyze system/ network designs for compliance implications. Experience with security tooling such as vulnerability scanners, SIEMS, container security, system configuration baseline checks (e.g. CIS Benchmarks, STIGs, etc.) Demonstrated experience partnering with and preparing information system owners for internal assessments, facilitating and leading external audits, and driving gaps and findings to closure in a collaborative manner Strong understanding of security program and control frameworks, assessment methodologies, and practices, i.e. NIST RMF, NIST CSF, ISO-27001, 800-53(a), 800-171(a), CMMC, CNSSI 1253, 800-137, PCI, HIPAA, GDPR, etc Experience evaluating third-party risk, communicating with external stakeholders, and supporting appropriate mitigations. Strong communication skills across all organizational levels and ability to build cross-organizational coalitions Direct experience with external audits, regulatory compliance reviews and examinations. Project and program management experience, tooling integration, and delivery in highly fluid environments Processional certifications such as CISA, CISM, CISSP, GSNA, ISO 27001 auditor, PCI ISA or QSA, or equivalent certifications ADDITIONAL REQUIREMENTS: Must be willing to travel (

Responsibilities

Lead and support security audits and certification efforts while partnering with engineers to gather and validate technical evidence. Identify security control gaps and drive timely resolution with engineers.