{"id":1601883,"url":"https://alion.io/job/lyft-senior-security-assurance-analyst","title":"Senior Security Assurance Analyst","company":{"id":234,"name":"Lyft","domain":"lyft.com","url":"https://alion.io/company/lyft","size_band":"1001-5000","is_staffing_agency":false,"employer_type":"direct","is_intermediary":false,"listed_via":null,"ats_vendor":"Greenhouse","truth_index":{"grade":"A","score":87,"open_postings":19,"ghost_share":0,"stale_share":0.526,"repost_share":0,"time_to_fill_p50_days":48,"computed_at":"2026-11-01T06:10:25Z"}},"role":"Security","role_family":"Security","seniority":"senior","employment_type":null,"work_mode":"hybrid","remote_scope":null,"remote_scope_basis":null,"remote_working_hours":null,"hiring_geo_confidence":"structured","locations":["New York, United States","Seattle, United States"],"countries":["US"],"hiring_countries":[],"hiring_countries_total":0,"salary":{"min":148000,"max":185000,"currency":"USD","period":"year","gross":null,"usd_annual":185000},"salary_estimate":null,"experience_years_min":5,"visa_sponsorship":false,"relocation_package":false,"has_equity":false,"technologies":[{"name":"Confluence","optional":false},{"name":"EU AI Act","optional":false},{"name":"GDPR","optional":false},{"name":"HIPAA","optional":false},{"name":"ISO 27001","optional":false},{"name":"Jira","optional":false},{"name":"LLM","optional":false},{"name":"NIST CSF","optional":false},{"name":"PCI DSS","optional":false},{"name":"SOC 2","optional":false},{"name":"AWS","optional":true},{"name":"Azure","optional":true},{"name":"GCP","optional":true}],"status":"live","first_seen_at":"2026-08-10T18:39:15Z","employer_posted_date":"2026-10-19","last_verified_at":"2026-11-01T14:08:14Z","board_verified":true,"closed_at":null,"days_open":82,"trust":{"level":"ok","repost_count":null,"flags":[],"days_open":82},"description":"At Lyft, our purpose is to serve and connect. We aim to achieve this by cultivating a work environment where all team members belong and have the opportunity to thrive.\nLyft connects people to transportation to change the way we live and get around our communities. Our drivers and passengers entrust Lyft with their personal information and travel details to get where they are going and expect us to keep that data safe. Lyft's Customer Trust team ensures that appropriate security controls and data protections are applied to meet our compliance requirements and customer contractual commitments. We conduct security risk assessments, consult with organizational stakeholders, monitor and continuously improve Lyft's Information Security program, facilitate third-party security audits, work with engineering teams to implement, automate, and monitor security controls, develop policies, and advise on all matters related to information security assurance.\nWe are looking for a highly motivated, organized, and detail-oriented individual to join our Customer Trust team. As a senior member of this team, you will own a portfolio of concurrent, multi-program compliance efforts and help ensure Lyft meets its enterprise promises and contractual commitments to customers on security and privacy across global markets. You'll manage relationships with external auditors and internal stakeholders, scale our program through efficient processes and automation, and serve as a trusted advisor on technical compliance matters spanning North America, the EU, and the UK.\nResponsibilities:\n Program & Audit Ownership\nOwn and lead our ISO 27001 compliance program end-to-end, from certification planning and internal audit through surveillance cycles and Statement of Applicability updates\nDrive execution across our multi-program compliance portfolio spanning SOC 2, PCI DSS, HIPAA, and NIST CSF, alongside global and international frameworks including UK Cyber Essentials, Spain ENS, and emerging EU regulations such as the Cyber Resilience Act (CRA), Radio Equipment Directive (RED), and NIS2\nServe as the primary liaison to external auditors, QSAs, and certification bodies, managing the full audit lifecycle across concurrent engagements and keeping internal stakeholders aligned on timelines and deliverables\nRisk, Policy & Stakeholder Advisory\nOwn the Security Risk Management Framework, ensuring risk identification, treatment, and reporting activities are consistently managed, tracked, and communicated across the business\nLead the development, review, and maintenance of internal information security and data protection policies, standards, and procedures, and drive policy awareness across the organization\nBuild and maintain strong cross-functional relationships with Engineering, Legal, Privacy, and Sales, advising on complex compliance requirements and translating technical risk into clear, actionable guidance for both technical and non-technical audiences\nSupport review of security provisions in customer contracts, MSAs, and security exhibits, partnering with Legal and Sales to provide clear, actionable security positions during negotiations\n Evidence, Automation & Tooling\nDrive evidence collection and continuous control testing using our workflow tools (Jira, Confluence), building scalable and repeatable processes across programs\nPartner with Engineering to design, implement, and monitor automated evidence collection, continuous control testing, and remediation tracking\nLeverage AI tools and LLM-based workflows to automate and improve compliance and assurance processes, documentation, and controls - for example accelerating evidence review, policy drafting, control testing, and questionnaire responses - and share effective approaches with the broader team\n Customer-Facing Assurance\nOwn responses to customer security questionnaires (e.g., CAIQ, SIG) and management of our external trust center (SafeBase), balancing transparency with proportional disclosure\nExperience:\n5+ years of experience in security governance, risk, and compliance (GRC), IT audit, or a related security assurance role\n5+ years of hands-on experience with ISO 27001 and PCI DSS\nIn-depth knowledge of other regulatory compliance and related assessments/certifications, including SOC 2, HIPAA, and NIST CSF\nExperience managing a multi-program compliance portfolio spanning global and international requirements, including EU and UK compliance frameworks, standards, or regulations\nExperience managing, reviewing, and drafting InfoSec policies and procedures\nStrong technical background with the ability to communicate and negotiate effectively with engineering teams\nExcellent cross-functional communication and leadership skills, with the ability to initiate and drive projects proactively and influence prioritization and strategic decisions\nAbility to manage a large workload and competing priorities amid resourcing constraints and tight deadlines\nStrong written and verbal communication skills, able to flex across technical, business, and executive audiences\nPreferred:Framework & Regulatory KnowledgeExperience across a combination of two or more of the following: ISO 27001, SOC 2, PCI DSS, SOX ITGC\nGDPR, EU AI Act, NIS2, or other international privacy/security compliance experience\n\n Technical & Program DepthExperience testing, designing, or documenting vulnerability management programs\nExperience reviewing security provisions in customer contracts (MSAs, DPAs, security addenda) and providing actionable feedback to Legal and Sales\n\n Tooling & AutomationExperience working with GRC platforms (e.g., AuditBoard CrossComply, Vanta, or Drata), Jira, and SafeBase\nExperience leveraging AI tools or large language models (LLMs) to automate, improve, or design compliance and assurance processes, documentation, or controls - for example AI-assisted evidence review, policy drafting, questionnaire completion, or pattern analysis across audit findings\n\nCertifications & BackgroundRelevant certifications such as CISA, CISSP, CISM, CRISC, or ISO 27001 Lead Auditor/Implementer\nBig 4 or Big 3 consulting experience\n\nNice to have: scripting and automation skills, experience with cloud technologies such as AWS/GCP/Azure\n\nBenefits: \nGreat medical, dental, and vision insurance options with additional programs available when enrolled\nMental health benefits\nFamily building benefits\nChild care and pet benefits\n401(k) plan with company match to help save for your future\nIn addition to 12 observed holidays, salaried team members have discretionary paid time off, hourly team members have 15 days paid time off\n18 weeks of paid parental leave. Biological, adoptive, and foster parents are all eligible\nSubsidized commuter benefits\nMonthly Lyft credits and complimentary Lyft Pink membership\nLyft is an equal opportunity employer committed to an inclusive workplace that fosters belonging. All qualified applicants will receive consideration for employment without regards to race, color, religion, sex, sexual orientation, gender identity, national origin, disability status, protected veteran status, age, genetic information, or any other basis prohibited by law. We also consider qualified applicants with criminal histories consistent with applicable federal, state and local law.\nLyft highly values having employees working in-office to foster a collaborative work environment and company culture. This role will be in-office on a hybrid schedule - Team Members will be expected to work in the office 3 days per week on Mondays, Wednesdays, and Thursdays. Lyft considers working in the office at least 3 days per week to be an essential function of this hybrid role. Your recruiter can share more information about the various in-office perks Lyft offers. Additionally, hybrid roles have the flexibility to work from anywhere for up to 4 weeks per year. #Hybrid\nThe expected base pay range for this position in the New York City area is $148,000 - $185,000, not inclusive of potential equity offering, bonus or benefits. Salary ranges are dependent on a variety of factors, including qualifications, experience and geographic location. Your recruiter can share more information about the salary range specific to your working location and other factors during the hiring process.","description_format":"text","description_chars":8291,"description_truncated":false,"requirements":{"experience_years_min":5,"management_years_min":null,"team_size_min":null,"manages_managers":false,"education":null,"security_clearance":false,"languages":[]},"benefits":["Equity","Parental leave","Vision insurance"],"hiring_locations":[{"name":"United States","iso":"US","kind":"country"}],"hiring_excludes":[],"relocation_offered":false,"industries":["Shared Mobility","Ride Hailing"],"lifecycle":[{"event":"open","at":"2026-10-01T19:31:50Z"}],"visa":[{"country":"US","licensed_sponsor":true,"evidence":"H-1B filings in 12 months: 101 · green card filings: 46","filings_12m":101,"filings_prev_12m":144,"green_card_filings_12m":46,"median_offered_wage_usd":147806,"route":null,"cap_exempt":false,"checked_at":"2026-10-29T16:27:21+00:00","sources":["US Department of Labor: LCA disclosure data (H-1B, H-1B1, E-3)","US Department of Labor: PERM disclosure data (green cards)"],"filings_for_role_12m":9}],"liveness":{"score":19,"band":"cold","label":"Long shot","p_open":1,"p_active":0.539,"p_room":0.36,"age_days":82,"expected_fill_days":48,"reasons":["conf:0","stale_co","velocity","win:tail","crowd:brand"],"computed_at":"2026-11-01T06:10:25Z"},"pay":{"stated_usd_annual":185000,"is_top_pay":true},"html_url":"https://alion.io/job/lyft-senior-security-assurance-analyst","json_url":"https://alion.io/job/lyft-senior-security-assurance-analyst.json","meta":{"generated_at":"2026-11-01T16:52:42Z","cache_seconds":300,"methodology":"https://alion.io/methodology","terms":"https://alion.io/terms","contact":"https://alion.io/contact","api":"https://alion.io/developers","about":"Alion is a live layer of people, companies and AI agents: who they are, whether they are real and active right now, what they do and how to work with them, readable by people and by agents and paid per call.","catalog":"https://alion.io/catalog.json","usage":{"tier":"crawler_verified","counted_by":"address","units_charged":1,"used_today":25827,"day_limit":null,"remaining_today":null,"minute_limit":300,"resets_at":"2026-11-02T00:00:00Z"}},"offers":[{"id":"company.slices","title":"One company in depth, by slice","status":"live","price":{"credits":0.02,"usd":0.002,"plus_per_slice":{"credits":0.05,"usd":0.005}},"unit":"per company, plus each slice with data","note":"the employer in depth","call":{"mcp_tool":"get_company","arguments":{"id":234},"rest":"https://alion.io/mcp/rest/get_company?id=234"},"human":"https://alion.io/catalog?offer=company.slices&for=job%2Flyft-senior-security-assurance-analyst"},{"id":"market.stats","title":"A market slice: pay, demand and time to fill","status":"live","price":{"credits":1,"usd":0.1},"unit":"per slice","note":"pay, demand and time to fill for this role and place","call":{"mcp_tool":"market_stats"},"human":"https://alion.io/catalog?offer=market.stats&for=job%2Flyft-senior-security-assurance-analyst"},{"id":"job.search","title":"Open jobs by role, technology, place, pay and visa","status":"live","price":{"credits":0.02,"usd":0.002},"unit":"per posting in a list","note":"similar open postings","call":{"mcp_tool":"search_jobs"},"human":"https://alion.io/catalog?offer=job.search&for=job%2Flyft-senior-security-assurance-analyst"},{"id":"company.verify","title":"Is this company real and active right now","status":"pilot","price":null,"unit":"per company","request":{"url":"https://alion.io/catalog/request","method":"POST","body":"{\"offer\": \"company.verify\", \"for\": \"job/lyft-senior-security-assurance-analyst\", \"note\": \"what you need it for\"}"},"human":"https://alion.io/catalog?offer=company.verify&for=job%2Flyft-senior-security-assurance-analyst"}],"agent":{"mcp":"https://alion.io/mcp/jobs","mcp_open":"https://alion.io/mcp/open","next":[{"tool":"get_job","arguments":{"id":1601883}},{"tool":"search_jobs","arguments":{"company":"lyft.com","detail":"compact"}},{"tool":"match_people","arguments":{"job_id":1601883},"note":"people open to offers who fit this vacancy"}],"note":"The same data through MCP tools: https://alion.io/mcp/open needs no sign-in (compact searches, postings, people); https://alion.io/mcp with an Alion account has everything. Docs: https://alion.io/developers"}}