• Analyze and continuously monitor cybersecurity and privacy policies, processes, compliance artifacts, system authorizations, and control effectiveness in an Azure cloud environment. • Map existing and proposed security controls and safeguards to compliance requirements for cloud services, including NIST and FedRAMP (Federal Risk and Authorization Management Program). • Manage the implementation of security and compliance controls, including Microsoft Entra ID (formerly Azure Active Directory) lifecycle management, Microsoft Sentinel, and related Azure security services. • Conduct architecture reviews and security impact assessments for technology initiatives and software delivery, documenting risk, compensating controls, and residual risk. • Coordinate application and infrastructure risk mitigation and vulnerability remediation activities with engineering and operations stakeholders. • Design, implement, and validate security controls to support compliance within a FedRAMP High environment. • Assess vulnerabilities and attacker tactics, techniques, and procedures (TTP) and provide incident response support to detect, contain, and prevent threats.

• Define and evolve product security architecture and strategy for Valon’s multi-tenant SaaS platform • Architect and guide secure implementation of customer-facing security capabilities in conjunction with Engineering (e.g., authentication / authorization models, identity integration, access controls, audit and logging, encryption / key management) • Build and maintain security reference architectures and standardized secure design patterns for product teams • Lead threat modeling, security design and code reviews for new features, services, and major architectural changes • Collaborate with Product, Engineering, Data, Compliance, Legal, and other teams to identify and drive mitigation for product and data security risks • Support vulnerability triage, remediation strategy, and root cause analysis for product security issues • Support security compliance and regulatory needs (e.g., SOC 2, CCPA, NYDFS, FTC), including customer-facing security discussions and due diligence • Develop, implement, and enforce security policies, standards, and procedures • Support operational activities including security advisory and consultative reviews, incident response, issue remediation, and other security processes

• Execute risk assessment testing supporting the Risk Manager. • Document risk assessment results. • Support Risk Manager in drafting risk assessment reports. • Perform administrative management of risk register (additions/editions/deletions, etc). • Document risk acceptance/exemptions that have been approved per the program. • Manage quarterly/annual review of risk acceptance/exceptions. • Manage risk assessment results in relevant dashboards. • Document Issues and Remediation activities for all exceptions noted during risk assessments. • Perform quarterly compliance assurance testing. • Document compliance testing results. • Maintain Management Action Plan (MAP) catalog with due dates. • Manage monthly audit MAPs. • Provide administrative support for ad-hoc external audits. • Provide administrative support for internal audits. • Support compliance program reporting activities.

• Define and maintain observability architecture and strategy, aligned with resilience and regulatory requirements; • Design and configure dashboards, SLOs/SLAs, and alerts for different stakeholders; • Develop scripts and automations for advanced administration and monitoring (Dynatrace, Python, Workflow); • Implement observability extensions and tools for non-native technologies and integration with OpenTelemetry; • Analyze data, optimize queries, and extract key business and capacity/performance management metrics; • Efficiently manage resources and licenses in Dynatrace DPS, ensuring compliance with DORA requirements.