Information Security Operations Specialist (Contract)

Workera AI; United States; Remote; USD 96,000 - 179,000; Part time

Job summary

Workera AI is seeking a hands-on Information Security Operations Specialist to own day-to-day security operations and maintain security frameworks within Vanta for a SaaS environment. You will interpret tests, coordinate remediation, and support vulnerability management, penetration testing, and security improvements.

As a contractor reporting to Staff People Engineer, you will collaborate with Infrastructure, Engineering, Product, IT, and GRC teams to ensure audit readiness and effective risk

Qualifications

• Hands-on vulnerability management in a SaaS environment.
• Experience translating security controls into technical evidence.
• Ability to work with cross-functional teams in a contractor role.

Responsibilities

• Own vulnerability management across cloud, apps, APIs, dependencies, and containers.
• Coordinate penetration testing and DAST; manage scope and remediation.
• Triage findings by severity; drive remediation with Eng & Infra.
• Partner with teams on monitoring, IAM, secure configuration, incident response.
• Upskill teams on vulnerability practices; maintain playbooks.

Skills

Vulnerability management

Penetration testing

Security operations

SOC 2 knowledge

ISO 27001 knowledge

AWS

Kubernetes

OWASP

Team collaboration

Tools

Vanta

DAST tools

CI/CD

Job description

Information Security Operations Specialist (SecOps & GRC)

Contractor | Workera

Role type: Contractor (40 hours)

Reports to: Staff People Engineer

Key partners: Infrastructure, Engineering, Product, IT, and GRC & Data Privacy.

Location: Americas

About the role

Workera is seeking a hands-on Information Security Operations Specialist to own day-to-day technical security operations and the operational maintenance of our security frameworks in Vanta.

This role independently interprets Vanta tests and maintenance requirements, coordinates technical evidence and remediation, and brings practical security expertise to vulnerability management, penetration testing, and security improvements. The GRC lead owns program direction, governance, and audit coordination. Customer security questionnaires are transitioning to another team; this role provides technical subject-matter support and validation rather than serving as the default questionnaire owner.

Responsibilities

Technical security operations

• Own vulnerability management across cloud infrastructure, applications, APIs, dependencies, containers, secrets, and infrastructure-as-code where applicable.
• Coordinate penetration testing and DAST: define scope, manage providers and access, review findings, track remediation, and organize retesting.
• Triage and prioritize findings based on severity, exposure, exploitability, and business impact; drive remediation with Engineering and Infrastructure, verify closure, and elevate overdue issues.
• Partner with technical teams on security monitoring, logging, identity and access, secure configuration, incident response, and technical risk reduction.
• Upskill Workera teams on vulnerability management, remediation practices, secure configuration, and security testing.
• Maintain practical security documentation, metrics, remediation records, and technical response playbooks.

GRC & Vanta maintenance

• Maintain Vanta tests and maintenance activities across SOC 2, ISO 27001, and ISO 42001.
• Independently read and interpret Vanta tests, map technical requirements to owners and evidence, identify gaps, and coordinate timely completion.
• Collect and validate technical evidence, support control operation and testing, document exceptions and remediation, and prepare for audits and assessments.
• Partner with the GRC lead to translate framework requirements into clear technical actions while the GRC lead retains ownership of the overall program.

Vendor risk & technical questionnaire support

• Lead vendor risk assessments, review SOC 2 reports and other security materials, document risks, and track follow-up actions.
• Provide technical subject-matter expertise for customer security questionnaires and due diligence requests as questionnaire ownership transitions elsewhere.
• Validate technical responses and supporting evidence for accuracy, consistency, and alignment with implemented controls.
• Support cross-functional security initiatives, technical readiness efforts, and transitions involving systems, tooling, and controls as business needs evolve.

Who you are

• A self-starter who can take ownership, create momentum, and operate independently in an evolving environment.
• A clear translator who can turn technical security concepts into concise, practical guidance that the broader organization can understand and act on.
• A quick learner who can absorb new systems, tools, and business context at startup speed.
• A thoughtful prioritizer who can distinguish urgent from important, focus on the highest-risk work, and adapt as priorities change.

Required capabilities

• Hands-on experience with vulnerability management, penetration testing design, security testing, remediation coordination, and technical security operations in a SaaS environment.
• Working knowledge of SOC 2, ISO 27001, and ISO 42001, with the ability to translate control requirements into technical evidence and actions.
• Hands-on experience with OWASP principles and security practices across AWS, Kubernetes, Elixir Programming Language
• Experience using a compliance or security platform such as Vanta and independently interpreting tests, maintenance tasks, and evidence requirements.
• Ability to work effectively with Engineering and Infrastructure teams, explain security issues clearly, and upskill others without creating unnecessary process.
• Strong judgment, documentation, prioritization, and communication skills; comfortable operating independently as a contractor.

What success looks like

• Vulnerabilities have clear owners, deadlines, remediation plans, and verified closure.
• Penetration tests and security testing cover agreed scope, with findings tracked through retesting.
• Vanta maintenance and technical evidence for SOC 2, ISO 27001, and ISO 42001 remain current and audit-ready.
• Workera teams have stronger, repeatable practices for vulnerability management and technical security operations.
• Vendor risks and technical questionnaire inputs are accurate, actionable, and appropriately owned.

About Workera
We’re a Silicon Valley company backed by NEA, Jump Capital, and Owl Ventures. Our founder is Kian Katanforoosh, an award-winning Stanford Computer Science Lecturer who has taught AI to over 1 million people. Our Chairman is Dr. Andrew Ng, co-founder of Coursera, CEO of DeepLearning.AI, and founding lead of the Google Brain project.

Our clients include Accenture, Siemens Energy, Samsung, and the United States Air Force.

Named to Fast Company’s Most Innovative Companies list alongside Microsoft and Canva. Recognized by the World Economic Forum’s Tech Pioneers, Inc 5000, and Josh Bersin’s HR Tech AI Trailblazers. In a world where every company claims to ‘do AI’, at Workera, it’s actually in our DNA.

We’re learners, builders, and dreamers. Join us.
Workera is committed to providing an inclusive and respectful environment where equal employment opportunities are available to all applicants and employees. We do not discriminate on the basis of race, color, religion, sex (including pregnancy, childbirth, or related medical conditions), national origin, age, disability, genetic information, sexual orientation, gender identity or expression, veteran status, or any other characteristic protected by applicable law. Hiring decisions are based on qualifications, merit, mindset, and business need.