Senior Compliance Research Analyst at Qualys in Pune

Job description

Come work at a place where innovation and teamwork come together to support the most exciting missions in the world! We are looking for a technically strong and detail-oriented Senior Compliance Research Analyst with 5–8 years of experience to join our Security Compliance and Research team. The ideal candidate will have strong hands-on expertise in Linux system administration and security hardening, compliance frameworks, technical control research, and automation using Python, Shell scripting, and PowerShell. This role involves independently researching, analyzing, developing, validating, and maintaining technical compliance policies and configuration standards based on industry benchmarks such as CIS Benchmarks and DISA STIGs. The candidate will translate security requirements into actionable technical controls, develop automated compliance checks, map controls to industry frameworks, and maintain high standards of technical accuracy and content quality across supported technologies. The ideal candidate should combine a strong understanding of operating systems and security configurations with a practical approach to scripting, automation, and AI-assisted tooling. The role requires ownership of assigned research and content development activities, independent problem-solving, and effective collaboration with cross-functional teams. Key Responsibilities 1. Technical Research and Compliance Policy Development Independently research, analyze, and interpret security benchmarks, technical standards, and compliance requirements, with a primary focus on Linux operating systems, followed by other operating systems, applications, databases, and network security devices. Translate security requirements into implementable technical controls, including configuration parameters, validation logic, expected values, remediation procedures, and supporting documentation. Analyze control intent, technical feasibility, security impact, and applicability across different technologies and platform versions. Map technical controls to security and compliance frameworks such as NIST SP 800-53, NIST CSF, ISO 27001, CIS Controls, and MITRE ATT&CK, where applicable. Take ownership of assigned compliance content throughout its lifecycle, ensuring consistency, traceability, and timely delivery. 2. Linux Systems Security and Hardening Apply Linux administration, troubleshooting, and security hardening practices across enterprise distributions, including RHEL, Rocky Linux, AlmaLinux, Ubuntu, and Debian. Analyze filesystem security, disk partitioning, mount options, logical volume management, and secure storage settings. Configure and validate SELinux, including enforcing mode, security contexts, policy behavior, and service confinement. Analyze kernel security parameters, unnecessary kernel modules, and other operating system hardening requirements. Develop and validate audit configurations, audit rules, log retention settings, and audit log analysis procedures to support security monitoring, traceability, and compliance verification. Research and implement secure authentication and access controls, including SSH hardening, PAM, sudo policies, password requirements, account restrictions, and scheduled task access controls. Assess Linux configuration settings and system services to identify security weaknesses and verify compliance with established hardening requirements. Develop scripts to validate system configurations against security benchmarks and identify deviations from expected secure settings. 3. Automation and AI-Assisted Tooling Develop and maintain reusable automation scripts using Python, Bash/Shell, and PowerShell for compliance validation and reporting. Translate technical benchmark requirements into automated checks and improve script reliability, maintainability, and error handling. Use AI-assisted tools and LLM-based workflows to accelerate research, script development, troubleshooting, and content validation, ensuring all outputs are tech