Product Security Analyst III

Summary

Join ExtraHop as a Product Security Analyst and contribute to strengthening the security and compliance of our market-leading products. Collaborate with experts to maintain compliance with frameworks like FedRAMP, SOC 2, and ISO 27001. Key responsibilities include managing vulnerability detection and response, leading the vulnerability management lifecycle, and assisting with compliance requirements for various standards. You will also develop a product security compliance roadmap and collaborate with team members to improve standards and policies. This role requires 5+ years of cybersecurity experience, including hands-on experience managing compliance programs and a bachelor's degree in a related field. ExtraHop offers a competitive salary, bonus, and benefits package.

Requirements

• 5+ years of experience in cybersecurity, with a focus on compliance frameworks like FedRAMP, SOC 2, or similar
• 2+ years of which should be hands-on experience specifically managing compliance programs, security assessments, or cloud security initiatives
• Bachelors degree in a related field such as Cybersecurity, Computer Science, Information Systems, Engineering or other technical field
• Direct experience with the FedRAMP compliance framework, including security control requirements, documentation and assessment methodologies
• Technical knowledge of web application security and cloud security, including best practices and controls for cloud-based environments
• Proficient with security tools, including vulnerability scanners, ticketing systems (e.g., Jira), compliance reporting platforms, and SIEM tools
• Exceptional analytical skills to effectively manage and resolve security and compliance issues
• Proven ability to communicate complex security concepts to technical and non-technical audiences
• All R&D Employees will be required to attend 2 mandatory in-person events every year. These events are typically held in our offices in downtown Seattle and run 4-5 days each
• Must be a US citizen or lawful permanent resident (i.e., green card holder) (in order to support restricted access network environments)

Responsibilities

• Run FedRAMP Continuous Monitoring (ConMon) processes and ensure successful monthly reviews with ExtraHop and agency stakeholders; manage asset inventory, vulnerability scan findings, and the Plan of Action & Milestones (POA&M) document
• Manage vulnerability detection and response pipelines, including tools, reporting and tracking
• Lead the vulnerability management lifecycle: triage, reporting, coordination with system owners, and remediation tracking
• Develop and provide vulnerability findings and responses for internal and external stakeholders, including customers
• Collaborate with the Director of Product Security to handle customer and pre-sales security inquiries
• Assist in addressing compliance requirements for various standards, (e.g., CSA STAR, ISO 27001, DoDIN APL, NIAP, FIPS, CMMC, IL4), supporting gap assessments and facilitating audits (including coordinating evidence collection and submission)
• Develop a product security compliance roadmap and coordinate key activities across the organization to achieve milestones
• Collaborate with Product Security team members to develop and improve standards, policies, procedures, documentation, and training
• Work with security information & event management (SIEM) tooling and other systems to perform security investigations
• Perform and/or lead security incident response activities
• Participate in an on-call rotation with occasional after-hours paging to review carefully prioritized security detections

Preferred Qualifications

• Experience supporting certifications like SOC 2, ISO 27001; familiarity with additional federal or industry security frameworks (e.g., CMMC, IL4, DoDIN APL, NIAP, FIPS)
• Strong project management skills with the ability to balance compliance initiatives and security operations
• Experience working in a security operations center (SOC) and/or leading security incident response activities
• Relevant security certifications such as CISSP, CISA, or CISM are preferred

Benefits

• Health, Dental, and Vision Benefits
• Flexible PTO, Sick Time Prorated Based on Date of Hire, and All Federal Holidays (US Only) + 3 Days of Paid Volunteer Time
• Non-Commissioned Positions may be eligible to participate in the Annual Discretionary Bonus Plan
• FSA and Dependent Care Accounts + EAP, where applicable
• Educational Reimbursement
• 401k with Employer Match or Pension where applicable
• Pet Insurance (US Only)
• Parental Leave (US Only)
• Hybrid and Remote Work Model