Lead, SaaS Security Posture Management

Job Classification:
Technology - Information Security Team & Role

As a Lead of Software as a Service (SaaS) Security Posture Management on the Vulnerability and Compliance Management Team, you will partner with other security professionals across the Information Security Office, the Chief Technology Office, and other groups within Prudential to drive the organization’s cloud security efforts across the global enterprise. You will oversee the security and compliance posture of our SaaS platforms, collaborate with corporate technology teams, Dev Ops, and ASM partners to enhance baseline capabilities, and identify and mitigate potential security risks to maintain a secure SaaS environment.

• Lead the SaaS vulnerability and compliance security strategy, including the design and implementation of attack surface reduction and security configurations across all SaaS platforms.
• Perform regular vulnerability and configuration assessments on SaaS applications to assess effectiveness and support hardening efforts.
• Track, prioritize, and remediate vulnerability and compliance issues identified in the platform, ensuring timely remediation.
• Implement automated policies for continuous monitoring and preventive controls.
• Lead SSPM vulnerability management efforts as the subject matter expert, collaborating across ISO organizations to prioritize systems and controls for attack surface reduction.
• Automate and define workflows for lifecycle management of SSPM findings, working in partnership with the ASM orchestration team.
• Instrument risk indicators and reporting.
• Collaborate with the Attack Surface Management team, SaaS Security team, and Third Party Governance to identify and address security risks associated with SaaS platforms and ensure proper mitigation.
• Develop and maintain SaaS security policies, procedures, and best practices in alignment with industry standards and regulatory requirements.
• Support and assist security incident response efforts related to SaaS environments, working closely with the Incident Response team.
• Conduct regular risk assessments and support evaluation of the effectiveness of security controls, identifying areas for improvement.
• Ensure SaaS platforms adhere to security compliance standards such as SOC 2, ISO 27001, GDPR, HIPAA, SOX, and others as required.
• Conduct regular compliance audits and assessments, working with auditors and internal teams to resolve gaps.
• Maintain documentation and artifacts for compliance reporting and certifications.
• Stay up-to-date with the latest security trends, threats, and technologies, recommending innovative solutions to enhance the organization’s security posture.
• Advocate for and implement security best practices throughout the SaaS development lifecycle.
• Provide mentorship, training, and guidance for team members, working with and guiding more junior team members.
• Support managers and Prudential leadership on new initiatives and opportunities to grow our security practices.
• Ensure proper communication of the program’s results, opportunities, and deficiencies, as needed, to Prudential upper management.
• Leverage Security Operations and tool/process specific knowledge to resolve complex technical/process/people problems the team faces.
• Review and approve remediation deferment requests, escalating where appropriate.

• Bachelor of Computer Science or Software Engineering or experience in related fields.
• Experience with agile development methodologies and Test-Driven Development (TDD).
• Knowledge of business concepts, tools and processes needed for making sound decisions in the context of the company's business.
• Ability to learn new skills and knowledge on an ongoing basis through self‑initiative and tackling challenges.
• Ability to coach others with some guidance and effectively leverage diverse ideas, experiences, thoughts, and perspectives to the benefit of the organization.
• Strong communication skills, with the ability to effectively communicate complex security concepts to technical and non‑technical stakeholders.
• Excellent problem‑solving, communication, and collaboration skills.
• Ability to think creatively, innovate and challenge…