Security Compliance Analyst

At Harbinger Motors, a Most Loved Workplace® certified employer in the Manufacturing space, Electrifying commercial transportation with American-made innovation and expertise.

<div class="content-intro"><p><span style="font-family: arial, helvetica, sans-serif; font-size: 12pt;"><strong>About Harbinger</strong></span></p>

<p><span style="font-family: arial, helvetica, sans-serif; font-size: 12pt;">Harbinger is an American commercial electric vehicle (EV) company on a mission to transform an industry starving for innovation. Harbinger’s best-in-class team of EV, battery, and drivetrain experts have pooled their deep experience to bring a first-of-its-kind EV platform to support the growing demand for medium-duty EVs and Hybrids. Harbinger: Familiar Form, Revolutionary Foundation.</span></p></div><p><span style="font-family: arial, helvetica, sans-serif;"><strong>Role Summary</strong></span></p>

<p><br><span style="font-family: arial, helvetica, sans-serif;">Harbinger is hiring a Security Compliance Analyst to build and own our security compliance program end to end. This is a hands-on, builder role: we're looking for someone who has already taken a compliance framework from gap assessment through an external audit and wants to do it again somewhere the program doesn't exist yet. You'll own the control set, the evidence behind it, the policies that describe it, and the tooling that holds it together. You'll grow into our expanding compliance scope as that work emerges with new business opportunities.</span></p>

<p> </p>

<p><span style="font-family: arial, helvetica, sans-serif;"><strong>What You'll Do: </strong></span></p>

<p><br><strong><span style="font-family: arial, helvetica, sans-serif;">Compliance Frameworks & Controls</span></strong></p>

<ul>

<li><span style="font-family: arial, helvetica, sans-serif;">Own the control catalog: implementation status, testing, evidence requirements, and crosswalks where frameworks overlap.</span></li>

<li><span style="font-family: arial, helvetica, sans-serif;">Translate control requirements into specific, actionable changes for teams to implement, then verify they landed.</span></li>

<li><span style="font-family: arial, helvetica, sans-serif;">Maintain the corrective action plan; open findings with named owners, real dates, and a defined evidence bar for closure partnering with program management on execution.</span></li>

</ul>

<p> </p>

<p><strong><span style="font-family: arial, helvetica, sans-serif;">Audit & Evidence Management</span></strong></p>

<ul>

<li><span style="font-family: arial, helvetica, sans-serif;">Run evidence collection on a standing cadence, building automations so evidence becomes a byproduct of normal operations rather than a quarterly scramble.</span></li>

<li><span style="font-family: arial, helvetica, sans-serif;">Prepare for and support external audits and certification assessments: readiness reviews, sample pulls, auditor walkthroughs, and remediation of findings.</span></li>

<li><span style="font-family: arial, helvetica, sans-serif;">Define and document our system boundary and scope decisions: what's in, what's deliberately out, and reasoning that holds up under an assessor's questions.</span></li>

</ul>

<p> </p>

<p><strong><span style="font-family: arial, helvetica, sans-serif;">Policy, Governance & Tooling</span></strong></p>

<ul>

<li><span style="font-family: arial, helvetica, sans-serif;">Write and maintain the policy and procedure set. Short enough that engineers read it, specific enough that an auditor accepts it.</span></li>

<li><span style="font-family: arial, helvetica, sans-serif;">Administer our GRC platform Vanta, including control mappings, integrations, framework crosswalks, and evidence freshness</span></li>

<li><span style="font-family: arial, helvetica, sans-serif;">Support role-based security awareness training and data handling guidance</span></li>

</ul>

<p> </p>

<p><strong><span style="font-family: arial, helvetica, sans-serif;">Third-Party Risk & Cross-Functional</span></strong></p>

<ul>

<li><span style="font-family: arial, helvetica, sans-serif;">Run vendor and third-party security reviews, including cloud services and the security requirements we flow down to suppliers.</span></li>

<li><span style="font-family: arial, helvetica, sans-serif;">Document control decisions, scope rationale, and audit outcomes in Jira or Confluence so the program is maintainable by others.</span></li>

<li><span style="font-family: arial, helvetica, sans-serif;">Report compliance posture and audit readiness to security leadership on a regular cadence.</span></li>

</ul>

<p> </p>

<p><span style="font-family: arial, helvetica, sans-serif;"><strong>Who You Are:</strong></span></p>

<p><br><strong><span style="font-family: arial, helvetica, sans-serif;">Education & Experience</span></strong></p>

<ul>

<li><span style="font-family: arial, helvetica, sans-serif;">Bachelor's degree in Information Systems, Cybersecurity, or related field (or equivalent experience).</span></li>

<li><span style="font-family: arial, helvetica, sans-serif;">5+ years in security compliance, GRC, or IT audit, including at least one framework taken from gap assessment through an external audit report or certification.</span></li>

<li><span style="font-family: arial, helvetica, sans-serif;">Experience in a startup or high-growth environment building a program rather than maintained one.</span></li>

<li><span style="font-family: arial, helvetica, sans-serif;">Security certifications (e.g. CISA, CRISC, CompTIA Security+, ISO 27001 Lead Auditor) are a plus.</span></li>

</ul>

<p><strong><span style="font-family: arial, helvetica, sans-serif;">Technical Competencies</span></strong></p>

<ul>

<li><span style="font-family: arial, helvetica, sans-serif;">Hands-on ownership of SOC 2 Type II and/or ISO/IEC 27001. Able to translate controls to other frameworks and compliance needs across all business units.</span></li>

<li><span style="font-family: arial, helvetica, sans-serif;">Experience with a certification audit where the outcome is pass or fail against a fixed control catalog, not an opinion accompanied by a management response.</span></li>

<li><span style="font-family: arial, helvetica, sans-serif;">Experience defining a system boundary and defending the scoping decision to an external assessor.</span></li>

<li><span style="font-family: arial, helvetica, sans-serif;">Familiarity with NIST-based control catalogs, mapping between overlapping frameworks, and the handling and storage controls that attach to restricted or contractually protected data.</span></li>

<li><span style="font-family: arial, helvetica, sans-serif;">Evidence and audit management: you can describe an evidence chain end to end: what artifact, generated how, refreshed how often, who attests.</span></li>

<li><span style="font-family: arial, helvetica, sans-serif;">GRC platform administration in Vanta configuring mappings and integrations.</span></li>

<li><span style="font-family: arial, helvetica, sans-serif;">Working in collaboration platforms like Confluence or Jira.</span></li>

<li><span style="font-family: arial, helvetica, sans-serif;">Scripting ability (e.g. Python or JavaScript) is a plus.</span></li>

</ul>

<p><strong><span style="font-family: arial, helvetica, sans-serif;">Soft Skills</span></strong></p>

<ul>

<li><span style="font-family: arial, helvetica, sans-serif;">Strong written and verbal communication; able to translate control requirements into concrete changes an engineer can act on.</span></li>

<li><span style="font-family: arial, helvetica, sans-serif;">Comfortable influencing teams that don't report to you, and staying with a position when the answer needs to be no.</span></li>

<li><span style="font-family: arial, helvetica, sans-serif;">Comfortable working cross-functionally in a fast-paced, high-growth manufacturing environment.</span></li>

<li><span style="font-family: arial, helvetica, sans-serif;">Documentation discipline: if it isn't written down, it didn't happen.</span></li>

</ul><div class="content-pay-transparency"><div class="pay-input"><div class="description"><div class="p-rich_text_section"><strong>Key Benefits & Perks:</strong></div>

<ul class="p-rich_text_list p-rich_text_list__bullet p-rich_text_list--nested" data-stringify-type="unordered-list" data-list-tree="true" data-indent="0" data-border="0">

<li data-stringify-indent="0" data-stringify-border="0">Comprehensive Health, Dental & Vision (HDV) – 100% employee covered</li>

<li data-stringify-indent="0" data-stringify-border="0">Early-stage Stock Options</li>

<li data-stringify-indent="0" data-stringify-border="0">Robust Retirement Savings (401k, HSA, FSA)</li>

<li data-stringify-indent="0" data-stringify-border="0">Generous Paid Time Off (PTO) & Parental Leave</li>

<li data-stringify-indent="0" data-stringify-border="0">Annual Vacation Bonus</li>

<li data-stringify-indent="0" data-stringify-border="0">Wellness & Fertility Benefits</li>

<li data-stringify-indent="0" data-stringify-border="0">Cell Phone Stipend</li>

<li data-stringify-indent="0" data-stringify-border="0">Complimentary Meals & Stocked Kitchens</li>

</ul></div><div class="title">California Pay Range</div><div class="pay-range"><span>$130,000</span><span class="divider">—</span><span>$160,000 USD</span></div></div></div><div class="content-conclusion"><div><span style="font-family: arial, helvetica, sans-serif; font-size: 8pt;"><strong>Equal Opportunity</strong></span></div>

<div><span style="font-family: arial, helvetica, sans-serif; font-size: 8pt;">Harbinger is an equal opportunity employer and complies with all applicable federal, state, and local fair employment practices laws. All qualified applicants will receive consideration for employment without regard to race, color, religion, national origin, ancestry, sex, sexual orientation, gender, gender expression, gender identity, genetic information or characteristics, physical or mental disability, marital/domestic partner status, age, military/veteran status, medical condition, or any other characteristic protected by law.</span></div>

<div> </div>

<div><span style="font-family: arial, helvetica, sans-serif; font-size: 8pt;">Harbinger is committed to ensuring that our hiring process is accessible for persons with disabilities. If you have a disability or limitation, such as those covered by the Americans with Disabilities Act, that requires accommodations to assist you in the search and application process, please email us at info@harbingermotors.com.</span></div>

<div> </div>

<div><span style="font-family: arial, helvetica, sans-serif; font-size: 8pt;"><strong>Candidate Data Privacy</strong></span></div>

<div><span style="font-family: arial, helvetica, sans-serif; font-size: 8pt;">Harbinger may collect, use and disclose your personal information or personal data (within the meaning of the applicable data protection laws) when you apply for employment and/or participate in our recruitment processes (“Candidate Personal Data”). This data includes contact, demographic, communications, educational, professional, employment, social media/website, network/device, recruiting system usage/interaction, security and preference information. Harbinger may use your Candidate Personal Data for the purposes of (i) tracking interactions with our recruiting system; (ii) carrying out, analyzing and improving our application and recruitment process, including assessing you and your application and conducting employment, background and reference checks; (iii) establishing an employment relationship or entering into an employment contract with you; (iv) complying with our legal, regulatory and corporate governance obligations; (v) recordkeeping; (vi) ensuring network and information security and preventing fraud; and (vii) as otherwise required or permitted by applicable law.</span></div>

<div> </div>

<div><span style="font-family: arial, helvetica, sans-serif; font-size: 8pt;">Harbinger may share your Candidate Personal Data with (i) internal personnel who have a need to know such information in order to perform their duties, including individuals on our HR, legal, and finance teams, and the team(s) with the position(s) for which you are applying; (ii) Harbinger affiliates; and (iii) Harbinger’s service providers, including providers of background checks, staffing services, and cloud services.</span></div>

<div> </div>

<div><span style="font-family: arial, helvetica, sans-serif; font-size: 8pt;">Harbinger may transfer or store internationally your Candidate Personal Data, including to or in the United States, Canada, the United Kingdom, and the European Union and in the cloud, and this data may be subject to the laws and accessible to the courts, law enforcement and national security authorities of such jurisdictions.</span></div>

<div> </div>

<div><span style="font-family: arial, helvetica, sans-serif; font-size: 8pt;">Please note that we are currently not accepting applications from third party application services. Any unsolicited resumes or candidate profiles submitted in response to our job posting shall be considered the property of Harbinger and are not subject to payment of referral or placement fees if any such candidate is later hired by Harbinger unless you have a signed written agreement in place with us which covers the applicable job posting.</span></div>

<p> </p></div>

Want to learn more about what it's like to work at Harbinger Motors? View our full profile.