<div class="content-intro"><p><span style="font-family: arial, helvetica, sans-serif; font-size: 12pt;"><strong>About Harbinger</strong></span></p> <p><span style="font-family: arial, helvetica, sans-serif; font-size: 12pt;">Harbinger is an American commercial electric vehicle (EV) company on a mission to transform an industry starving for innovation. Harbinger’s best-in-class team of EV, battery, and drivetrain experts have pooled their deep experience to bring a first-of-its-kind EV platform to support the growing demand for medium-duty EVs and Hybrids. Harbinger: Familiar Form, Revolutionary Foundation.</span></p></div><p><span style="font-family: arial, helvetica, sans-serif;"><strong>Role Summary</strong></span></p> <p><br><span style="font-family: arial, helvetica, sans-serif;">Harbinger is hiring a Security Compliance Analyst to build and own our security compliance program end to end. This is a hands-on, builder role: we're looking for someone who has already taken a compliance framework from gap assessment through an external audit and wants to do it again somewhere the program doesn't exist yet. You'll own the control set, the evidence behind it, the policies that describe it, and the tooling that holds it together. You'll grow into our expanding compliance scope as that work emerges with new business opportunities.</span></p> <p> </p> <p><span style="font-family: arial, helvetica, sans-serif;"><strong>What You'll Do: </strong></span></p> <p><br><strong><span style="font-family: arial, helvetica, sans-serif;">Compliance Frameworks & Controls</span></strong></p> <ul> <li><span style="font-family: arial, helvetica, sans-serif;">Own the control catalog: implementation status, testing, evidence requirements, and crosswalks where frameworks overlap.</span></li> <li><span style="font-family: arial, helvetica, sans-serif;">Translate control requirements into specific, actionable changes for teams to implement, then verify they landed.</span></li> <li><span style="font-family: arial, helvetica, sans-serif;">Maintain the corrective action plan; open findings with named owners, real dates, and a defined evidence bar for closure partnering with program management on execution.</span></li> </ul> <p> </p> <p><strong><span style="font-family: arial, helvetica, sans-serif;">Audit & Evidence Management</span></strong></p> <ul> <li><span style="font-family: arial, helvetica, sans-serif;">Run evidence collection on a standing cadence, building automations so evidence becomes a byproduct of normal operations rather than a quarterly scramble.</span></li> <li><span style="font-family: arial, helvetica, sans-serif;">Prepare for and support external audits and certification assessments: readiness reviews, sample pulls, auditor walkthroughs, and remediation of findings.</span></li> <li><span style="font-family: arial, helvetica, sans-serif;">Define and document our system boundary and scope decisions: what's in, what's deliberately out, and reasoning that holds up under an assessor's questions.</span></li> </ul> <p> </p> <p><strong><span style="font-family: arial, helvetica, sans-serif;">Policy, Governance & Tooling</span></strong></p> <ul> <li><span style="font-family: arial, helvetica, sans-serif;">Write and maintain the policy and procedure set. Short enough that engineers read it, specific enough that an auditor accepts it.</span></li> <li><span style="font-family: arial, helvetica, sans-serif;">Administer our GRC platform Vanta, including control mappings, integrations, framework crosswalks, and evidence freshness</span></li> <li><span style="font-family: arial, helvetica, sans-serif;">Support role-based security awareness training and data handling guidance</span></li> </ul> <p> </p> <p><strong><span style="font-family: arial, helvetica, sans-serif;">Third-Party Risk & Cross-Functional</span></strong></p> <ul> <li><span style="font-family: arial, helvetica, sans-serif;">Run vendor and third-party security reviews, including cloud services and the security requirements we flow down to suppliers.</span></li> <li><span style="font-family: arial, helvetica, sans-serif;">Document control decisions, scope rationale, and audit outcomes in Jira or Confluence so the program is maintainable by others.</span></li> <li><span style="font-family: arial, helvetica, sans-serif;">Report compliance posture and audit readiness to security leadership on a regular cadence.</span></li> </ul> <p> </p> <p><span style="font-family: arial, helvetica, sans-serif;"><strong>Who You Are:</strong></span></p> <p><br><strong><span style="font-family: arial, helvetica, sans-serif;">Education & Experience</span></strong></p> <ul> <li><span style="font-family: arial, helvetica, sans-serif;">Bachelor's degree in Information Systems, Cybersecurity, or related field (or equivalent experience).</span></li> <li><span style="font-family: arial, helvetica, sans-serif;">5+ years in security compliance, GRC, or IT audit, including at least one framework taken from gap assessment through an external audit report or certification.</span></li> <li><