QA & Validation Specialist

DataDrone Inc.; Cheyenne (WY); Hybrid; USD 90,000 - 130,000; Full time

Benefits offered by this job

Timezone flexibility

Remote work option

Job summary

DataDrone Inc. is seeking a QA & Validation specialist to verify every artifact produced by the POD, ensuring configurations, scan policies, health checks, and dashboards are correct before client delivery.

You will collaborate with SMEs and engagement teams to build evidence-backed pass/fail criteria, perform gates, and walk runbooks with client engineers to secure Day-45 sign-off.

Qualifications

• Depth in security QA, audits or independent validation.
• Ability to surface issues with evidence rather than fixes.
• Strong documentation review and runbook skills.
• Familiarity with vulnerability management platforms (Qualys, Rapid7, Tenable, Nessus).
• Experience building test cases from Acceptance Criteria.
• Clear written communication with pass/fail logging.

Responsibilities

• Verify every POD artifact: configuration, scans, authentication health, dashboards.
• Validate integration wires and end-to-end synthetic findings.
• Produce audit-ready documentation and reproducible runbooks.
• Manage Day-21 and Day-30 gates with evidence-based pass/fail.
• Walk runbooks with client engineers and secure Day-45 sign-off.

Skills

Security QA

Independent validation

Documentation review

Vulnerability management

Test case design

Written communication

Tools

Qualys

Rapid7

Tenable

Nessus

Job description

DataDrone runs a Qualys implementation practice that ships outcomes in 45 days. Not a license shop. Not a generalist consultancy. Every engagement starts with one Hero use case and ends with the client team running a Qualys deployment they actually trust — at mid-market and lower-enterprise, where Qualys's value gets stranded most often.

QA & Validation is the gatekeeper. The seat that decides whether something ships. You don't build, you verify. You don't fix, you surface. The QA sign-off is the gate between "we think it works" and "it works for the client."

What You'll Do

You verify everything the POD ships. Configuration (asset coverage, scan policies, authentication health, dashboards). Integration wires (synthetic findings end-to-end at every severity boundary). Documentation pack (runbooks reproducible by a client engineer with zero context). Acceptance Criteria (every signed criterion verified independently before Day 45 close).

You run the Day-21 acceptance gate. You verify the Day-30 check-in packets before they go to the client. You walk runbooks with client engineers. You hold the Day-45 sign-off — your signature is the gate. Or its absence is.

You partner with the Qualys SME on what a good configuration looks like, the Integration Engineer on what a working wire looks like, the Engagement Manager on rhythm and routing, and the Sales & Account Executive on what the engagement is actually committed to. You verify against all three — independently.

You will not be doing build work or fixing what you find. You'll surface failures with specific evidence and route them back. The build seats fix and resubmit. You verify the resubmission. Loop until pass or until withheld — both in writing.

Daily Rhythm (How You Operate)

• Morning POD stand-up, midday verification block — running test cases, walking runbooks, generating synthetic findings. End-of-day verification log refresh.
• Independent evidence is the bar. "It works in a sandbox" is not verification. "The SME said it's tuned" is not verification. Console export, log entry, report, or recording — or it didn't pass.
• Cultural maxim: "Verify, never trust. Nothing ships unverified. The QA sign-off is the gate."
• Timezone Flexibility — clients pick NA / EMEA / APAC; we mirror.

Key Responsibilities

• Build the verification plan from Requirements Pack Section 6 Acceptance Criteria + Hero success criteria; sign with EM and SME by Day 7.
• Pre-stage test fixtures during the Build sprint; catch issues before the Day-21 gate, not at it.
• Run the Day-21 acceptance gate with pass/fail / conditional-pass per criterion, each backed by evidence.
• Verify the Day-30 check-in packets (Configuration + Coverage & Findings) before they reach the client.
• Run integration boundary tests — synthetic Critical / High / Medium / Low at every code path (console, API, scanner-generated).
• Verify the compliance evidence package generates audit-ready output.
• Walk every dashboard with its audience owner; confirm "this answers my question."
• Walk runbooks with a client engineer; verify reproducibility from documentation alone.
• Hold the Day-45 sign-off authority — signed when evidence holds, withheld in writing when it doesn't.

What We're Looking For

• Real depth in security QA, audit, or independent validation — eye for what auditors look for.
• Independence — comfortable saying "not yet" to the rest of the POD without making it personal.
• Detail-oriented documentation reviewer — can spot a missing runbook section or a stale configuration reference at a glance.
• Familiarity with vulnerability management platforms (Qualys, Rapid7, Tenable, Nessus) and the standard failure modes.
• Comfort building test cases from Acceptance Criteria — derived, not improvised.
• Written-by-default communication — every pass/fail/conditional-pass logged with evidence.

Bonus Points For

• Past compliance/audit work against SOC 2, PCI, HIPAA, FedRAMP, or ISO 27001.
• Past experience walking runbooks with client engineers and catching the stuff developers miss.
• Past contribution to a partner practice's test case library or failure-mode catalog.

The Mindset We Hire For

• Verify, never trust. Independent evidence or it didn't pass.
• Independence is the seat. The gate stays uncaptured by the rest of the POD.
• Surface, don't fix. Your route fails back with specific evidence; the build seats fix and resubmit.
• In writing. Pass / fail / conditional-pass — all logged with evidence link.
• Nothing ships unverified. Not the platform, not the wires, not the documentation, not the dashboards.
• The sign-off is the gate. Withhold when it should be withheld. Sign when it should be signed.

Success in This Role

• 30 days: POD rhythm internalized; first engagement's verification plan signed at Day 7; Day-21 gate run cleanly.
• 60 days: First engagement closed; Day-45 sign-off given with full evidence; warranty window clean.
• 90 days: Second engagement underway with sharper verification; test case library extended.

Tools You'll Use

Qualys console (read-only), synthetic finding test suite, documentation hub, project tracker for the verification log, recording surface (Loom / screen capture) for evidence walks, the practice's AI Copilot loaded with the test case library + failure-mode catalog + audit-readiness patterns.

Why Join Us

You're not running checkbox QA for a reseller — you're the gate that decides whether a Qualys deployment ships in a state the client can actually run. The practice rewards independence over politeness, written evidence over verbal assurance, and the discipline to say "not yet" when "yes" would feel easier.

You pick where you land on the clock — NA / EMEA / APAC — and we mirror. Timezone Flexibility is built into the practice; you don't fit yourself into someone else's day.

Self-Check Before You Apply

• I derive test cases from signed criteria, not from improvisation.
• I verify with independent evidence — console export, log, report — never "the SME said."
• I'm comfortable saying "not yet" to a seasoned SME without making it personal.
• I log every pass/fail / conditional-pass with an evidence link.
• I walk runbooks with client engineers and hold the line on reproducibility.
• I'd rather withhold Day-45 sign-off than rubber-stamp a conditional pass.

If three or more are yes, that's you — apply.