Infrastructure Compliance Analyst – Hybrid

About the role

The Infrastructure Compliance Analyst III serves as a senior security advisor to Infrastructure Engineering, working closely with Cloud, Platform, Site Reliability, and Systems Engineering teams. The role translates security, governance, and regulatory requirements into practical, secure infrastructure solutions while reducing organizational risk.

Key responsibilities

• Partner with engineering teams throughout design, implementation, and operation to ensure infrastructure is secure, scalable, resilient, and compliant.
• Interpret security frameworks, regulatory mandates, and internal policies into actionable guidance for engineers.
• Provide expertise on secure architecture, OS hardening, identity management, cloud and network security, encryption, and certificate management.
• Collaborate with GRC and Information Security to align compliance objectives, audit requirements, and risk priorities.
• Guide vulnerability remediation, prioritize findings, and validate successful fixes.
• Develop and maintain secure configuration standards using DISA STIGs, vendor hardening guidance, and organizational baselines.
• Assist teams in applying compliant configurations across Windows, Linux, virtualization platforms, cloud services, identity platforms, storage systems, and enterprise infrastructure.
• Analyze vulnerability, compliance, and operational data to identify trends and recommend strategic security improvements.

Required profile

• Proven experience in infrastructure security and compliance within a complex, multi‑cloud environment.
• Strong understanding of security frameworks, regulatory requirements, and GRC processes.
• Ability to communicate technical security concepts to engineering and business stakeholders.
• Experience guiding remediation efforts and developing secure configuration standards.

Required skills

• Windows operating systems
• Linux operating systems
• Virtualization platforms
• Cloud services (public and private)
• Identity management
• Encryption and certificate management
• Network security
• Secure architecture design
• Operating system hardening
• DISA STIGs and vendor hardening guidance