Security Assurance Analyst, Security and Privacy

Responsibilities

Third Party Risk Assessments

• Review vendor or partner requests from internal stakeholders, understanding the business purpose
• Work with external stakeholders to collect relevant security and data protection information from third parties
• Review the information and accurately assess and document the risk, and propose potential mitigations
• Security Questionnaires
• Draft responses to customer security questionnaires (e.g., CAIQ, SIG) and assist in the management of our external trust center (SafeBase)

Program Management

• Help senior team members in managing workflows, queues, and tools
• Help the team track and compile reporting and metrics

Required

1-3 years of program management experience supporting third party risk management and security compliance and assurance

Knowledge of security frameworks such as ISO 27001, SOC 2, PCI DSS, SOX ITGC, or with international privacy/security regulations such as GDPR, EU AI Act, NIS2, or other international privacy/security compliance experience

Excellent attention to detail and organizational skills

Ability to manage a large workload and competing priorities amid resourcing constraints and tight deadlines

Strong written and verbal communication skills across technical, business, and executive audiences

Interest in leveraging AI tools or large language models (LLMs), including tools like Claude or Gemini, to automate, improve, or design compliance and assurance processes, documentation, or controls — for example AI-assisted evidence review, policy drafting, questionnaire completion, or pattern analysis across audit findings

Familiarity with with GRC platforms (e.g., AuditBoard CrossComply, Vanta, or Drata), Safebase, Jira, and vendor management tools

Knowledge of microservices SaaS product infrastructures or tech stacks a plus

Education

Bachelor's degree in Information Systems, Computer Science, Cybersecurity, Data Science, or a related field preferred

Relevant certifications such as Comptia Security+, Network+, PMP, CIPP a plus

Lyft highly values having employees working in-office to foster a collaborative work environment and company culture.

This role will be in-office on a hybrid schedule following the establishment of a Lyft office in Mexico City — Team Members will be expected to work in the office 3 days per week on Mondays, Wednesdays, and Thursdays.

Lyft considers working in the office at least 3 days per week to be an essential function of this hybrid role. Additionally, hybrid roles have the flexibility to work from anywhere for up to 4 weeks per year. #Hybrid

Please submit your resume in English.