Information Security Operations Specialist (SecOps & GRC)

Contractor | Workera

Role type: Contractor (40 hours)

Reports to: Staff People Engineer

Key partners: Infrastructure, Engineering, Product, IT, and GRC & Data Privacy.

Location: Americas

About the role

Workera is seeking a hands-on Information Security Operations Specialist to own day-to-day technical security operations and the operational maintenance of our security frameworks in Vanta.

This role independently interprets Vanta tests and maintenance requirements, coordinates technical evidence and remediation, and brings practical security expertise to vulnerability management, penetration testing, and security improvements. The GRC lead owns program direction, governance, and audit coordination. Customer security questionnaires are transitioning to another team; this role provides technical subject-matter support and validation rather than serving as the default questionnaire owner.

Responsibilities

^{Technical security operations}

• Own vulnerability management across cloud infrastructure, applications, APIs, dependencies, containers, secrets, and infrastructure-as-code where applicable.
• Coordinate penetration testing and DAST: define scope, manage providers and access, review findings, track remediation, and organize retesting.
• Triage and prioritize findings based on severity, exposure, exploitability, and business impact; drive remediation with Engineering and Infrastructure, verify closure, and escalate overdue issues.
• Partner with technical teams on security monitoring, logging, identity and access, secure configuration, incident response, and technical risk reduction.
• Upskill Workera teams on vulnerability management, remediation practices, secure configuration, and security testing.
• Maintain practical security documentation, metrics, remediation records, and technical response playbooks.

GRC & Vanta maintenance

• Maintain Vanta tests and maintenance activities across SOC 2, ISO 27001, and ISO 42001.
• Independently read and interpret Vanta tests, map technical requirements to owners and evidence, identify gaps, and coordinate timely completion.
• Collect and validate technical evidence, support control operation and testing, document exceptions and remediation, and prepare for audits and assessments.
• Partner with the GRC lead to translate framework requirements into clear technical actions while the GRC lead retains ownership of the overall program.

Vendor risk & technical questionnaire support

• Lead vendor risk assessments, review SOC 2 reports and other security materials, document risks, and track follow-up actions.
• Provide technical subject-matter expertise for customer security questionnaires and due diligence requests as questionnaire ownership transitions elsewhere.
• Validate technical responses and supporting evidence for accuracy, consistency, and alignment with implemented controls.
• Support cross-functional security initiatives, technical readiness efforts, and transitions involving systems, tooling, and controls as business needs evolve.

Who you are

• A self-starter who can take ownership, create momentum, and operate independently in an evolving environment.
• A clear translator who can turn technical security concepts into concise, practical guidance that the broader organization can understand and act on.
• A quick learner who can absorb new systems, tools, and business context at startup speed.
• A thoughtful prioritizer who can distinguish urgent from important, focus on the highest-risk work, and adapt as priorities change.

Required capabilities

• Hands-on experience with vulnerability management, penetration testing design, security testing, remediation coordination, and technical security operations in a SaaS environment.
• Working knowledge of SOC 2, ISO 27001, and ISO 42001, with the ability to translate control requirements into technical evidence and actions.
• Hands-on experience with OWASP principles and security practices across AWS, Kubernetes, Elixir Programming Language
• Experience using a compliance or security platform such as Vanta and independently interpreting tests, maintenance tasks, and evidence requirements.
• Ability to work effectively with Engineering and Infrastructure teams, explain security issues clearly, and upskill others without creating unnecessary process.
• Strong judgment, documentation, prioritization, and communication skills; comfortable operating independently as a contractor.

What success looks like

• Vulnerabilities have clear owners, deadlines, remediation plans, and verified closure.
• Penetration tests and security testing cover agreed scope, with findings tracked through retesting.
• Vanta maintenance and technical evidence for SOC 2, ISO 27001, and ISO 42001 remain current and audit-ready.
• Workera teams have stronger, repeatable practices for vulnerability management and technical security operations.
• Vendor risks and technical questionnaire inputs are accurate, actionable, and appropriately owned.