Harbor is seeking a Security Analyst to join our internal IT Operations team. This role is responsible for strengthening Harbor’s security posture through proactive vulnerability management, third-party risk management (TPRM), and client-facing security assurance activities. The ideal candidate brings hands-on experience with vulnerability scanning tools (particularly Qualys), strong analytical skills, and the ability to communicate security practices effectively across internal and external stakeholders.

This is a fully remote position located in Canada or the Philippines and must align with United States working business hours (EST).

Key Responsibilities:

Vulnerability Management (Qualys-Focused)

• Administer and operate Qualys for continuous vulnerability scanning across infrastructure, endpoints, and cloud environments
• Analyze scan results, prioritize vulnerabilities based on risk, and coordinate remediation efforts with infrastructure and engineering teams
• Track remediation progress and produce reporting dashboards and metrics for leadership
• Continuously improve vulnerability management processes, including SLAs, exception handling, and risk acceptance workflows

Third-Party Risk Management (TPRM)

• Support and manage the third-party risk lifecycle, including vendor onboarding, assessments, and periodic reviews
• Evaluate vendor security posture using standardized frameworks (e.g., SIG, CAIQ, or equivalent)
• Maintain vendor risk inventory and ensure alignment with internal security policies

Client Security Questionnaires & Assurance

• Own and respond to client security questionnaires, RFPs, and due diligence requests
• Collaborate with internal stakeholders to ensure accurate, consistent, and timely responses
• Maintain a centralized knowledge base of standard responses to improve efficiency and consistency
• Support audits and client security reviews as needed

Security Posture & Governance

• Review, update, and maintain security policies, standards, and procedures
• Identify gaps in current security controls and recommend improvements aligned with industry frameworks (e.g., SOC2, ISO 27001)
• Partner with IT and engineering teams to enhance overall security posture and maturity
• Stay current on emerging threats, vulnerabilities, and best practices

Incident Support & General Security Operations

• Assist in the investigation and response to security incidents and vulnerabilities
• Support internal security initiatives, including awareness, compliance, and risk reduction efforts
• Contribute to continuous improvement of security tooling and processes

Required Qualifications:

• 4+ years of experience in information security, cybersecurity, or a related field
• Hands-on experience with vulnerability management tools (preferably Qualys)
• Experience responding to client security questionnaires or audit requests
• Foundational understanding of network security concepts (firewalls, SIEM, IDS/IPS, endpoint protection)
• Familiarity with risk management principles, including third-party/vendor risk
• Familiarity with M365 Security Tools, Exchange Online Protection, Purview, a plus.

Preferred Qualifications

• Experience with TPRM programs or vendor risk platforms
• Knowledge of security frameworks (ISO 27001, SOC 2)
• Experience with remediation tracking and security metrics/reporting
• Familiarity with penetration testing concepts and vulnerability exploitation techniques

Education & Certifications

• Bachelor’s degree in Computer Science, Information Security, or related field (or equivalent experience)

Why Join Us

This is a unique opportunity for a talented compliance professional to step into a high-visibility, hands-on role that blends operational responsibility with strategic influence. You'll be more than a contributor—you'll be a builder, shaping the frameworks and processes that support our global compliance objectives.

Whether you're a seasoned analyst ready for a bigger challenge or an emerging leader looking to expand your scope, this role offers the chance to grow with purpose and advance your career in a forward-thinking, high-impact environment.

About the Role

We are seeking a proactive, detail-oriented Compliance Sr Analyst to join our global Governance, Risk & Compliance (GRC) team. You will take ownership of key elements of our Continuous Monitoring (ConMon) program, partner with technical teams to track risks and improve control effectiveness, and maintain the common control framework (CCF) that underpins our security, privacy, and compliance posture.

This role is designed for someone who enjoys getting into the details while also thinking strategically about how to optimize compliance processes, scale efficiently, and contribute to audit readiness and regulatory alignment.

Key Responsibilities

• Own and evolve the enterprise-wide Continuous Monitoring (ConMon) program, ensuring that vulnerabilities are identified, tracked, and remediated, with accurate reporting and documentation.
• Conduct recurring control assessments to evaluate the effectiveness of technical, administrative, and operational safeguards, and use results to improve the CCF.
• Develop and maintain the Common Control Framework (CCF), ensuring alignment across regulatory and certification requirements (e.g., SOC 2, ISO 27001, PCI-DSS, NIST 800-53, DORA, C5).
• Manage the risk exception and deviation process, including intake, review, documentation, and tracking of compensating controls.
• Facilitate compliance syncs with internal teams, including Security, Engineering, IT, Legal, and Privacy. Drive action item closure, escalate risks, and promote visibility.
• Support audit and assessment readiness by aligning evidence to controls, updating documentation, and coordinating with process owners to demonstrate compliance posture.
• Maintain core compliance documentation, including policies, SOPs, control narratives, risk registers, and corrective action plans.
• Assist in incident response documentation, focusing on compliance impacts, reporting obligations, and post-incident reviews.
• Collaborate with Security and Engineering to review vulnerability scans and threat intelligence, helping assess risk exposure and prioritize remediation.
• Develop and manage compliance dashboards, metrics, and POA&M-style tracking to communicate program health and maturity.
• Continuously improve compliance processes, identifying automation opportunities, reducing manual tasks, and evolving the CCF to keep pace with a changing risk landscape.

Qualifications

• 3+ years of experience in compliance, audit, security assurance, or a related field within a technology or SaaS environment.
• Knowledge of major regulatory and industry frameworks (e.g., NIST SP 800-53, SOC 2, ISO 27001, PCI-DSS).
• Experience with vulnerability management, risk assessments, and control testing.
• Strong communication and collaboration skills with the ability to work across business and technical teams.
• Proven ability to manage multiple priorities, with attention to detail and a structured, documentation-driven approach.
• Bachelor’s degree in a relevant field or equivalent professional experience.

Preferred Skills

• Familiarity with tools like Tenable, Wiz, or other vulnerability scanners.
• Experience with GRC platforms (e.g., OneTrust, Drata, ServiceNow).
• Certifications such as CISA, CISSP, CRISC, or ISO 27001 Lead Auditor/Implementer.
• Knowledge of data protection regulations like GDPR, HIPAA, or DORA.

Company Benefits

• Company stocks
• Annual merit increase based on performance
• 15% night shift differential pay
• Paid Leave with Cash Conversion
• HMO with free dependents
• Retirement Plan
• Life Insurance
• While on work from home setup: Internet and meal allowance are provided
• Employee Assistance Program for mental and social well-being
• Government-mandated Benefits (SSS, PhilHealth, PagIBIG, 13^th month pay, Solo parent leave, Special leave for women)

#LI-MB1