QA & Validation Specialist

Data Drone runs a Qualys implementation practice that ships outcomes in 45 days. Not a license shop. Not a generalist consultancy. Every engagement starts with one Hero use case and ends with the client team running a Qualys deployment they actually trust — at mid-market and lower-enterprise, where Qualys's value gets stranded most often.

QA & Validation is the gatekeeper. The seat that decides whether something ships. You don't build, you verify. You don't fix, you surface. The QA sign-off is the gate between "we think it works" and "it works for the client."

You verify everything the POD ships. Configuration (asset coverage, scan policies, authentication health, dashboards). Integration wires (synthetic findings end-to-end at every severity boundary). Documentation pack (runbooks reproducible by a client engineer with zero context). Acceptance Criteria (every signed criterion verified independently before Day 45 close).

You run the Day-21 acceptance gate. You verify the Day-30 check-in packets before they go to the client. You walk runbooks with client engineers. You hold the Day-45 sign-off — your signature is the gate. Or its absence is.

You partner with the Qualys SME on what a good configuration looks like, the Integration Engineer on what a working wire looks like, the Engagement Manager on rhythm and routing, and the Sales & Account Executive on what the engagement is actually committed to. You verify against all three — independently.

You will not be doing build work or fixing what you find. You'll surface failures with specific evidence and route them back. The build seats fix and resubmit. You verify the resubmission. Loop until pass or until withheld — both in writing.

• Morning POD stand-up, midday verification block — running test cases, walking runbooks, generating synthetic findings. End-of-day verification log refresh.
• Independent evidence is the bar. "It works in a sandbox" is not verification. "The SME said it's tuned" is not verification. Console export, log entry, report, or recording — or it didn't pass.
• Cultural maxim: "Verify, never trust. Nothing ships unverified. The QA sign-off is the gate."
• Timezone Flexibility — clients pick NA / EMEA / APAC; we mirror.

• Build the verification plan from Requirements Pack Section 6 Acceptance Criteria + Hero success criteria; sign with EM and SME by Day 7.
• Pre-stage test fixtures during the Build sprint; catch issues before the Day-21 gate, not at it.
• Run the Day-21 acceptance gate with pass/fail / conditional-pass per criterion, each backed by evidence.
• Verify the Day-30 check-in packets (Configuration + Coverage & Findings) before they reach the client.
• Run integration boundary tests — synthetic Critical / High / Medium / Low at every code path (console, API, scanner-generated).
• Verify the compliance evidence package generates audit-ready output.
• Walk every dashboard with its audience owner; confirm "this answers my question."
• Walk runbooks with a client engineer; verify reproducibility from documentation alone.
• Hold the Day-45 sign-off authority — signed when evidence holds, withheld in writing when it doesn't.

• Real depth in security QA, audit, or independent validation — eye for what auditors look for.
• Independence — comfortable saying "not yet" to the rest of the POD without making it personal.
• Detail-oriented documentation reviewer — can spot a missing runbook section or a stale configuration reference at a glance.
• Familiarity with vulnerability management platforms (Qualys, Rapid7, Tenable, Nessus) and the standard failure modes.
• Comfort building test cases from Acceptance Criteria — derived, not improvised.
• Written-by-default communication — every…