Senior Security Analyst

THE CAREER OPPORTUNITY

This role is a high‑impact opportunity to shape and mature the security posture of a cloud‑native SaaS organization. As a senior member of the Information Security & Compliance team, you will own key elements of the application security, cloud security, and detection/response ecosystem while partnering closely with engineering, DevOps, CloudOps, and compliance stakeholders.

You will directly influence how securely PowerPlan’s products are designed, developed, and operated across the SDLC. This is a hands‑on role for someone who wants meaningful responsibility, visibility with leadership, and the ability to drive measurable outcomes across a rapidly evolving environment.

COMPANY

PowerPlan specializes in enterprise software solutions used by organizations with complex financial, regulatory, and operational needs. We deliver secure, cloud‑hosted SaaS products that help customers manage critical workflows with accuracy, transparency, and compliance.

The security team plays a central role in protecting customer trust, enabling rapid product innovation, and ensuring alignment with frameworks such as SOC 2, ISO 27001, and NIST CSF 2.0. We operate in a collaborative environment that values technical depth, continuous improvement, and responsible innovation.

KEY PERFORMANCE OBJECTIVES (First 12 Months)

OBJECTIVE 1: Implement a Centralized Application Vulnerability Management Platform (First 120 Days)

Outcome:

Deploy a consolidated platform (e.g., DefectDojo) that aggregates SAST, DAST, SCA, penetration‑testing, and manual‑review findings within 120 days. Ensure all engineering teams have visibility into normalized, prioritized findings, with assignment and SLA workflows in place. Produce monthly reports showing coverage, SLA adherence, and remediation progress.

Impact:

Provides a “single pane of glass” that enables consistent prioritization, eliminates fragmented tooling silos, and measurably reduces MTTR for application vulnerabilities. Improves audit readiness and strengthens engineering alignment by creating a unified source of truth for risk decisions.

How:

Evaluate and implement the platform, integrate scanning tools and pen‑test reports, configure cross‑team workflows, onboard engineering groups, define remediation SLAs, and publish monthly dashboards to engineering and security leadership.

OBJECTIVE 2: Lead the Annual Application Cloud Penetration Testing Program (Annual Cycle)

Outcome:

Coordinate annual penetration testing for web applications, APIs, and cloud environments; ensure final reports are processed within 30 days. Track remediation and retesting and ensure all critical/high‑risk findings are addressed within SLA. Maintain audit‑ready documentation for compliance teams.

Impact:

Ensures independent validation of application and cloud security posture, reduces exploitable weaknesses, and directly supports SOC 2 and ISO 27001 evidence requirements. Builds leadership confidence through measurable remediation accountability.

How:

Manage vendor selection and scoping, coordinate technical access and test data, review findings, facilitate engineering remediation, validate fixes, capture evidence, and update Confluence with all required artifacts and timelines.

OBJECTIVE 3: Implement a Standardized Security Architecture Review Process (First 120 Days)

Outcome:

Establish and operationalize a design‑review process for all major new product features and third‑party integrations within 120 days. Produce documented review artifacts, identified risks, and required remediation actions for development teams. Ensure findings are incorporated before release.

Impact:

Reduces late‑cycle rework, prevents design‑level security gaps, and embeds security as a natural part of the product development lifecycle. Improves release confidence and accelerates secure deployment across the SaaS platform.

How:

Create templates, facilitate threat‑model discussions (e.g., STRIDE), review integration risks, track remediation items, collaborate with engineering leads, and maintain documented review outcomes in shared repositories.

OBJECTIVE 4: Drive Measurable Maturity Improvements Aligned to NIST CSF 2.0 (First 12 Months)

Outcome:

Deliver measurable improvements across NIST CSF functions through documented workflows, baseline control assessments, performance metrics, and quarterly KPI reporting. Create repeatable processes and audit‑ready artifacts across Identify, Protect, Detect, Respond, and Recover.

Impact:

Strengthens the formal structure and reliability of the security program, reduces operational and compliance risk, and enhances readiness for SOC 2 and ISO 27001 by demonstrating consistent, evidence‑based maturity growth.

How:

Assess current control gaps, standardize repeatable workflows, document runbooks and procedures, collaborate with engineering and compliance, automate where practical, and present quarterly maturity dashboards.

OBJECTIVE 5: Strengthen Cross‑Functional Collaboration Across Dev, CloudOps, IT & Compliance (First 6–9 Months)

Outcome:

Implement recurring cross‑team security syncs, remediation checkpoints, and shared KPI dashboards. Drive measurable improvements in SLA adherence, cloud misconfiguration reduction, recurring‑vulnerability prevention, and overall operational alignment.

Impact:

Builds unified, organization‑wide ownership of security responsibilities, accelerates remediation cycles, and reduces risk introduced by siloed decisions or inconsistent practices.

How:

Establish communication cadences, run joint review sessions, align remediation expectations, publish shared dashboards, and deliver clear visibility to leadership on cross‑team security performance.

WHAT YOU BRING

• Hands on experience with application security scanning (SAST/DAST/SCA), pen‑testing coordination, and vulnerability management platforms.
• Strong working knowledge of CrowdStrike, Qualys, and/or Rapid7.
• Cloud security experience in AWS and/or Azure, including IAM, logging, and posture management.
• Experience performing or facilitating threat modeling and architecture reviews.
• Familiarity with SOC 2, ISO 27001, and NIST CSF 2.0.
• Strong analytical, communication, and documentation skills.
• Ability to partner effectively across engineering, DevOps, CloudOps, IT, and compliance teams.
• Demonstrated ability to drive process maturity and measurable improvements.

PowerPlan is an EOE”

https://info.powerplan.com/ApplicantPrivacyNotice

Please note that this is a hybrid role that involves a combination of onsite work from our corporate office as well as work from home. While we strive to accommodate flexible working arrangements when sensible, there will be times when onsite work is required. This could include scheduled office days, team meetings, client meetings, or special events.