Senior Security Assurance Analyst

At Lyft, our purpose is to serve and connect. We aim to achieve this by cultivating a work environment where all team members belong and have the opportunity to thrive.

Lyft connects people to transportation to change the way we live and get around our communities. Our drivers and passengers entrust Lyft with their personal information and travel details to get where they are going and expect us to keep that data safe. Lyft's Customer Trust team ensures that appropriate security co...

We are looking for a highly motivated, organized, and detail-oriented individual to join our Customer Trust team. As a senior member of this team, you will own a portfolio of concurrent, multi-program compliance efforts and help ensure Lyft meets its enterprise promises and contractual commitments to customers on se...

Program & Audit Ownership
Own and lead our ISO 27001 compliance program end-to-end, from certification planning and internal audit through surveillance cycles and Statement of Applicability updates
Drive execution across our multi-program compliance portfolio spanning SOC 2, PCI DSS, HIPAA, and NIST CSF, alongside global and international frameworks including UK Cyber Essentials, Spain ENS, and emerging EU regulations such as the Cyber Resilience Act (CRA), Radio Equipment Directive (RED), and NIS2
Serve as the primary liaison to external auditors, QSAs, and certification bodies, managing the full audit lifecycle across concurrent engagements and keeping internal stakeholders aligned on timelines and deliverables
Risk, Policy & Stakeholder Advisory
Own the Security Risk Management Framework, ensuring risk identification, treatment, and reporting activities are consistently managed, tracked, and communicated across the business
Lead the development, review, and maintenance of internal information security and data protection policies, standards, and procedures, and drive policy awareness across the organization
Build and maintain strong cross-functional relationships with Engineering, Legal, Privacy, and Sales, advising on complex compliance requirements and translating technical risk into clear, actionable guidance for both technical and non-technical audiences
Support review of security provisions in customer contracts, MSAs, and security exhibits, partnering with Legal and Sales to provide clear, actionable security positions during negotiations
Evidence, Automation & Tooling
Drive evidence collection and continuous control testing using our workflow tools (Jira, Confluence), building scalable and repeatable processes across programs
Partner with Engineering to design, implement, and monitor automated evidence collection, continuous control testing, and remediation tracking
Leverage AI tools and LLM-based workflows to automate and improve compliance and assurance processes, documentation, and controls — for example accelerating evidence review, policy drafting, control testing, and questionnaire responses — and share effective approaches with the broader team
Customer-Facing Assurance
Own responses to customer security questionnaires (e.g., CAIQ, SIG) and management of our external trust center (SafeBase), balancing transparency with proportional disclosure
5+ years of experience in security governance, risk, and compliance (GRC), IT audit, or a related security assurance role
5+ years of hands-on experience with ISO 27001 and PCI DSS
In-depth knowledge of other regulatory compliance and related assessments/certifications, including SOC 2, HIPAA, and NIST CSF
Experience managing a multi-program compliance portfolio spanning global and international requirements, including EU and UK compliance frameworks, standards, or regulations
Experience managing, reviewing, and drafting InfoSec policies and procedures
Strong technical background with the ability to communicate and negotiate effectively with engineering teams
Excellent cross-functional communication and leadership skills, with the ability to initiate and drive projects proactively and influence prioritization and strategic decisions
Ability to manage a large workload and competing priorities amid resourcing constraints and tight deadlines
Strong written and verbal communication skills, able to flex across technical, business, and executive audiences
Preferred:
Framework & Regulatory Knowledge
Experience across a combination of two or more of the following: ISO 27001, SOC 2, PCI DSS, SOX ITGC
GDPR, EU AI Act, NIS2, or other international privacy/security compliance experience
Technical & Program Depth
Experience testing, designing, or documenting vulnerability management programs
Experience reviewing security provisions in customer contracts (MSAs, DPAs, security addenda) and providing actionable feedback to Legal and Sales
Tooling & Automation
Experience working with GRC platforms (e.g., AuditBoard CrossComply, Vanta, or Drata), Jira, and SafeBase
Experience leveraging AI tools or large language models (LLMs) to automate, improve, or design compliance and assurance processes, documentation, or controls — for example AI-assisted evidence review, policy drafting, questionnaire completion, or pattern analysis across audit findings
Certifications & Background
Relevant certifications such as CISA, CISSP, CISM, CRISC, or ISO 27001 Lead Auditor/Implementer
Big 4 or Big 3 consulting experience
Nice to have: scripting and automation skills, experience with cloud technologies such as AWS/GCP/Azure