Senior Security Assurance Analyst

Role Overview

Lyft's Customer Trust team ensures that appropriate security controls and data protections are applied to meet compliance requirements and customer contractual commitments. As a Senior Security Assurance Analyst, you will own a portfolio of concurrent, multi-program compliance efforts across global markets (North America, EU, UK), manage relationships with external auditors and internal stakeholders, scale programs through efficient processes and automation, and advise on technical compliance matters.

Responsibilities

Program & Audit Ownership

• Own and lead the ISO 27001 compliance program end-to-end, from certification planning and internal audit through surveillance cycles and Statement of Applicability updates.
• Drive execution across a multi-program compliance portfolio spanning SOC 2, PCI DSS, HIPAA, and NIST CSF, alongside global and international frameworks including UK Cyber Essentials, Spain ENS, and emerging EU regulations (Cyber Resilience Act, RED, NIS2).
• Serve as the primary liaison to external auditors, QSAs, and certification bodies across concurrent engagements.

Risk, Policy & Stakeholder Advisory

• Own the Security Risk Management Framework, ensuring risk identification, treatment, and reporting activities are managed and communicated.
• Lead the development, review, and maintenance of internal information security and data protection policies, standards, and procedures.
• Build and maintain cross-functional relationships with Engineering, Legal, Privacy, and Sales to advise on compliance requirements and technical risk.
• Support review of security provisions in customer contracts, MSAs, and security exhibits.

Evidence, Automation & Tooling

• Drive evidence collection and continuous control testing using workflow tools (Jira, Confluence).
• Partner with Engineering to design, implement, and monitor automated evidence collection, continuous control testing, and remediation tracking.
• Leverage AI tools and LLM-based workflows to automate and improve compliance processes, documentation, and controls.

Customer-Facing Assurance

• Own responses to customer security questionnaires (e.g., CAIQ, SIG) and management of the external trust center (SafeBase).

Qualifications

Required

• 5+ years of experience in security governance, risk, and compliance (GRC), IT audit, or a related security assurance role.
• 5+ years of hands-on experience with ISO 27001 and PCI DSS.
• In-depth knowledge of compliance frameworks including SOC 2, HIPAA, and NIST CSF.
• Experience managing a multi-program compliance portfolio spanning global/international requirements (EU, UK).
• Experience managing, reviewing, and drafting InfoSec policies and procedures.
• Strong technical background with the ability to communicate and negotiate effectively with engineering teams.
• Ability to manage competing priorities and tight deadlines.

Preferred

• Experience across combinations of ISO 27001, SOC 2, PCI DSS, and SOX ITGC.
• Experience with GDPR, EU AI Act, NIS2, or other international privacy/security compliance frameworks.
• Experience testing, designing, or documenting vulnerability management programs.
• Experience reviewing security provisions in contracts (MSAs, DPAs, security addenda).
• Experience with GRC platforms (e.g., AuditBoard CrossComply, Vanta, Drata), Jira, and SafeBase.
• Experience leveraging AI tools or LLMs to automate compliance processes.
• Relevant certifications such as CISA, CISSP, CISM, CRISC, or ISO 27001 Lead Auditor/Implementer.
• Big 4 or Big 3 consulting experience.
• Scripting and automation skills, with experience in cloud technologies (AWS, GCP, Azure).