Security Assurance Analyst, Security and Privacy
About this role
Organized professionals who thrive at the intersection of security compliance, vendor risk management, and process automation will find a strong fit within Lyft's Privacy and Compliance team. This group protects user data and ensures adherence to regulatory obligations by running security risk assessments, guiding internal stakeholders, and helping engineering teams implement protective controls.
Day-to-day work centers on evaluating third-party vendors, completing customer security questionnaires, and streamlining operational workflows. Team members also explore how large language models can automate evidence review and policy drafting. Anyone comfortable balancing multiple compliance frameworks while collaborating closely with external partners and internal engineering groups will succeed here.
What you will do
- Review vendor and partner requests from internal stakeholders to understand underlying business purposes.
- Collaborate with external stakeholders to gather relevant security and data protection documentation from third parties.
- Assess and document vendor risk accurately while proposing appropriate mitigations.
- Draft responses to customer security questionnaires and help manage the external trust center.
- Assist senior team members in managing operational workflows, task queues, and team tools.
- Help track and compile reporting metrics for the compliance program.
What you need
- Bring one to three years of program management experience supporting third-party risk management and security compliance.
- Demonstrate familiarity with security frameworks like ISO 27001, SOC 2, PCI DSS, or international regulations such as GDPR.
- Maintain strong written and verbal communication skills tailored for technical, business, and executive audiences.
- Show interest in leveraging AI tools and large language models like Claude or Gemini to automate compliance and assurance processes.
- Possess familiarity with governance, risk, and compliance platforms, ticketing tools, and vendor management software.
Nice to have
- Knowledge of microservices SaaS product infrastructures or tech stacks
- Relevant certifications such as CompTIA Security+, Network+, PMP, or CIPP
Benefits
- Flexibility to work from anywhere for up to 4 weeks per year
Skills and tech stack
Questions candidates ask
What is the remote work or in-office policy for this role?
This role follows a hybrid schedule once the Mexico City office is established, requiring team members to work in the office three days per week on Mondays, Wednesdays, and Thursdays. Additionally, hybrid roles offer the flexibility to work from anywhere for up to four weeks per year.
What tools and tech stack will I use?
You will utilize GRC platforms like AuditBoard CrossComply, Vanta, or Drata, along with Safebase, Jira, and vendor management tools. The team also has an interest in leveraging AI tools and large language models such as Claude or Gemini to automate compliance processes.
What kind of experience is required for this position?
Candidates need one to three years of program management experience supporting third-party risk management and security compliance and assurance. Knowledge of security frameworks like ISO 27001, SOC 2, or GDPR is also required.