The posting
Come work at a place where innovation and teamwork come together to support the most exciting missions in the world!
We are looking for a technically strong and detail-oriented Senior Compliance Research Analyst with 5–8 years of experience to join our Security Compliance and Research team. The ideal candidate will have strong hands-on expertise in Linux system administration and security hardening, compliance frameworks, technical control research, and automation using Python, Shell scripting, and PowerShell.
This role involves independently researching, analyzing, developing, validating, and maintaining technical compliance policies and configuration standards based on industry benchmarks such as CIS Benchmarks and DISA STIGs. The candidate will translate security requirements into actionable technical controls, develop automated compliance checks, map controls to industry frameworks, and maintain high standards of technical accuracy and content quality across supported technologies.
The ideal candidate should combine a strong understanding of operating systems and security configurations with a practical approach to scripting, automation, and AI-assisted tooling. The role requires ownership of assigned research and content development activities, independent problem-solving, and effective collaboration with cross-functional teams.
Key Responsibilities
1. Technical Research and Compliance Policy Development
- Independently research, analyze, and interpret security benchmarks, technical standards, and compliance requirements, with a primary focus on Linux operating systems, followed by other operating systems, applications, databases, and network security devices.
- Translate security requirements into implementable technical controls, including configuration parameters, validation logic, expected values, remediation procedures, and supporting documentation.
- Analyze control intent, technical feasibility, security impact, and applicability across different technologies and platform versions.
- Map technical controls to security and compliance frameworks such as NIST SP 800-53, NIST CSF, ISO 27001, CIS Controls, and MITRE ATT&CK, where applicable.
- Take ownership of assigned compliance content throughout its lifecycle, ensuring consistency, traceability, and timely delivery.
2. Linux Systems Security and Hardening
- Apply Linux administration, troubleshooting, and security hardening practices across enterprise distributions, including RHEL, Rocky Linux, AlmaLinux, Ubuntu, and Debian.
- Analyze filesystem security, disk partitioning, mount options, logical volume management, and secure storage settings.
- Configure and validate SELinux, including enforcing mode, security contexts, policy behavior, and service confinement.
- Analyze kernel security parameters, unnecessary kernel modules, and other operating system hardening requirements.
- Develop and validate audit configurations, audit rules, log retention settings, and audit log analysis procedures to support security monitoring, traceability, and compliance verification.
- Research and implement secure authentication and access controls, including SSH hardening, PAM, sudo policies, password requirements, account restrictions, and scheduled task access controls.
- Assess Linux configuration settings and system services to identify security weaknesses and verify compliance with established hardening requirements.
- Develop scripts to validate system configurations against security benchmarks and identify deviations from expected secure settings.
3. Automation and AI-Assisted Tooling
- Develop and maintain reusable automation scripts using Python, Bash/Shell, and PowerShell for compliance validation and reporting.
- Translate technical benchmark requirements into automated checks and improve script reliability, maintainability, and error handling.
- Use AI-assisted tools and LLM-based workflows to accelerate research, script development, troubleshooting, and content validation, ensuring all outputs are technically verified.
4. Content Development and Collaboration
- Define and maintain control categories, subcategories, criticality ratings, control statements, and remediation guidance in accordance with established content standards.
- Analyze benchmark updates, security recommendations, and customer requirements to maintain and improve assigned compliance content.
- Collaborate with Development, QA, and Infrastructure teams to implement required controls, resolve technical issues and deliver reliable results within committed timelines.
Compliance Content Quality and Process Excellence
- Establish and follow standardized quality and validation procedures for compliance policies, technical controls, and automated checks.
- Perform thorough technical validation and reviews to identify inaccuracies, inconsistencies, and gaps before content release.
- Ensure compliance content is complete, traceable, and supported by accurate technical documentation, research references, and remediation guidance.
- Continuously improve testing, review, and content management processes to reduce defects and maintain consistent quality across supported technologies.
Required Skills and Experience
- 5–8 years of relevant professional experience, including at least 5 years of hands-on Linux administration and security hardening.
- Strong proficiency in Python and Bash/Shell scripting, with working knowledge of PowerShell.
- Practical familiarity with security benchmarks such as CIS Benchmarks or DISA STIGs.
- Strong analytical, technical research, and troubleshooting skills, with the ability to work independently and resolve complex technical challenges.
- Demonstrated ownership, attention to detail, and commitment to technical accuracy, documentation quality, and delivery timelines.
Required Soft Skills
- Strong written and verbal communication skills.
- Ownership, accountability, and attention to detail.
- Effective collaboration and prioritization across multiple assignments.
- Proactive approach to problem-solving and continuous improvement.
Preferred Qualifications
- Experience with automated security assessment or compliance content platforms.
- Exposure to cloud platforms, containers, Kubernetes, or database security.
- Relevant certifications such as RHCSA, RHCE, Security+.
