Staff Security Engineer - GRC at Harness

Bengaluru, karnataka, India -

Full Time

Start Date

Immediate

Expiry Date

04 Jun, 26

Salary

0.0

Posted On

06 Mar, 26

Experience

5 year(s) or above

Remote Job

Yes

Telecommute

Yes

Sponsor Visa

Skills

GRC, Security Posture, Compliance Certifications, SOC 2, ISO 27001, ISO 27017, ISO 27018, PCI-DSS, HIPAA, Risk Assessments, Policy Development, Vendor Risk Management, Cloud-Native, Kubernetes, SBOMs, SLSA

Industry

Software Development

Description

Harness is the AI Software Delivery Platform company, led by technologist and entrepreneur Jyoti Bansal (founder of AppDynamics, acquired by Cisco for $3.7B). Harness has raised approximately $570M in funding and is valued at $5.5B, backed by leading investors including Goldman Sachs, Menlo Ventures, IVP, Unusual Ventures, Citi Ventures, and more. As AI accelerates code creation, the real bottleneck has shifted to everything after the code – testing, deployments, application security, reliability, compliance, and cost optimization. Harness brings AI and automation to this “outer loop,” helping teams ship software faster while maintaining security and governance throughout the entire software delivery lifecycle. Powered by Harness AI and the Software Delivery Knowledge Graph, the Harness Platform applies deep context and intelligent automation across the software delivery lifecycle with governance and policy-driven controls embedded throughout the platform. Over the past year, Harness powered over 185M deployments, 82M builds, 18T flag evaluations, 8M security scans, 9.1B optimized tests, 3T protected API calls, and helped manage $2.8B in cloud spend — enabling customers like United Airlines, Morningstar, and Choice Hotels to accelerate releases by up to 75%, reduce cloud costs by up to 60%, and achieve 10x DevOps efficiency. With a global team across 14 offices and 25 countries, Harness is shaping the future of AI software delivery — and we’re looking for exceptional talent to help us move even faster. Position Summary A Staff Security Engineer will be a member of the GRC team working within the Information Security organization and across the business to advise, build, and operate security and compliance programs at scale. Utilizing in-depth expertise across multiple disciplines, a Senior Security Analyst is responsible for executing various components of Harness’ security posture and overseeing end-to-end solutions to complex problems. As a Staff Security Engineer, you will lead security efforts to acquire and maintain compliance certifications (e.g., SOC 2, ISO 27001, ISO 27017, ISO 27018, PCI-DSS, and HIPAA), design solutions that enable Harness’ security goals, and collaborate directly with business and engineering teams to preserve velocity while ensuring security. You will be responsible for defining and implementing security and compliance capabilities, as well as leading efforts to provide transparency to customers, prospects, and internal stakeholders. In this role, you will: Own the PCI-DSS program at Harness as the subject matter expert Design, implement, and continuously monitor PCI-DSS controls, collaborating with engineering teams to ensure the PCI environment is properly scoped, segmented, and secured; Contribute precise and actionable guidance to ensure security and privacy by design for engineering and business initiatives; Lead and deliver internal and external audits, risk assessments, and annual compliance certifications across the technical estate; Execute core security capabilities such as policy and procedure development, and security awareness and training requirements; Support customer trust initiatives such as reviewing contracts for security and privacy requirements, completing questionnaires and requests, and maintaining our customer trust portal; Continuously monitor and manage supply chain security and vendor risk management; Drive security and compliance across the business through empathetic partnership. Measure control and program effectiveness, recommending new strategies to manage risk; Articulate Harness’s security capabilities and controls to enterprise customers or auditors; and Identify security gaps, develop or support the development of a path forward to address them, and ensure the plan is fully executed and working as intended. About You You have at least 5-8 years of relevant industry experience. You have exposure to industry regulations, frameworks, and compliance certifications (ISO 27001, SOC 2, PCI, NIST, FedRAMP, SOX, HIPAA etc.); You have previous experience in a cloud-native environment (AWS, GCP, or Azure); You have previous experience assessing and utilizing AI in a secure environment. You have exposure to or experience with Kubernetes, SBOMs, SLSA, and/or DLP You have previous experience with GRC tools or building automation. You have a strong cybersecurity acumen. You have a solid technical proficiency. You want to work in a high-growth environment and build new programs from scratch; You have a keen attention to detail. You are comfortable handling the unknown, and you can bring clarity to ambiguous situations; and, You are proactive, results-driven, and an excellent collaborator and communicator. Bonus Points! You hold relevant security or technical certifications (ISO 27001 Lead Implementer or Lead Auditor, PCI QSA, CISA, CISSP, AWS/GCP Professional). You are familiar with what’s going on under the hood of the AWS or GCP console and can speak to best practices for configuration and management. You are eager to learn and to invest your knowledge in junior colleagues. You like to automate the boring stuff. Work Location Bangalore, India Harness in the news: Accelerating Our Mission to Bring AI to Everything After Code Goldman Sachs leads investment in software delivery startup Harness at $5.5 billion valuation How Harness runs 16 “startups within a startup” at scale | Jyoti Bansal Harness Research Shows AI Visibility Crisis Fueling Security Nightmare Harness has been named to the Inc. Power Partner list for software delivery success All qualified applicants will receive consideration for employment without regard to race, color, religion, sex or national origin. Note on Fraudulent Recruiting/Offers We have become aware that there may be fraudulent recruiting attempts being made by people posing as representatives of Harness. These scams may involve fake job postings, unsolicited emails, or messages claiming to be from our recruiters or hiring managers. Please note, we do not ask for sensitive or financial information via chat, text, or social media, and any email communications will come from the domain @harness.io. Additionally, Harness will never ask for any payment, fee to be paid, or purchases to be made by a job applicant. All applicants are encouraged to apply directly to our open jobs via our website. Interviews are generally conducted via Zoom video conference unless the candidate requests other accommodations. If you believe that you have been the target of an interview/offer scam by someone posing as a representative of Harness, please do not provide any personal or financial information and contact us immediately at security@harness.io. You can also find additional information about this type of scam and report any fraudulent employment offers via the Federal Trade Commission’s website (https://consumer.ftc.gov/articles/job-scams), or you can contact your local law enforcement agency.

Responsibilities

This role involves advising, building, and operating security and compliance programs at scale within the Information Security organization, focusing on acquiring and maintaining various compliance certifications like SOC 2 and PCI-DSS. The engineer will lead security efforts, design enabling solutions, and collaborate with business and engineering teams to ensure security while preserving velocity.