Information Security and Compliance Analyst

Role Overview: We are seeking a proactive Information Security and Compliance Analyst to support our security assurance, risk management, and customer trust programs. This role serves as a primary point of contact for customer security evaluations and third-party security testing while actively managing security tools, compliance evidence, and remediation activities. The ideal candidate combines hands-on security operations experience with strong project management, technical writing, and cross-functional communication skills.

Key Responsibilities

Security Governance & Operations

• Maintain security policies, standard operating procedures, and compliance tracking.
• Monitor ongoing vendor risk and help maintain internal compliance evidence.
• Monitor and manage information security tools, including CrowdStrike Falcon, Rapid7 AppSec Insights, Proofpoint, Okta, Intune, and Datadog.
• Penetration Testing & Remediation Management: Plan and coordinate third-party network, application, and cloud penetration tests, including scope, rules of engagement, scheduling, and logistics with external testers and internal engineering and IT teams.
• Triage findings, translate vulnerabilities into actionable engineering tasks, track remediation through verification and retesting, and prepare executive-ready status summaries.

Customer Trust & Security Assurance

• Own the end-to-end process of completing customer security questionnaires, Vendor Risk Assessments (VRAs), and RFPs accurately and within established SLAs.
• Build, maintain, and expand a centralized knowledge base / answer library of standard responses, security documentation, and audit artifacts (e.g., SOC 2, ISO 27001, policy docs).
• Partner with Sales and Account Management to join customer security calls when technical deep dives are required.

Qualifications & Experience

• Experience: 2–4 years of experience in Information Security, GRC, IT audit, or customer-facing technical support with a strong security focus.
• Security Familiarity: Working knowledge of common security frameworks and standards (SOC 2 Type II, ISO 27001, NIST CSF, GDPR/CCPA).
• Technical Acumen: Ability to speak knowledgeably about cloud architecture (AWS/Azure/GCP), encryption standards, access control (SSO/MFA), network security, and common vulnerability categories (OWASP Top 10).
• Communication Skills: Excellent technical writing skills with an ability to tailor technical explanations for customer risk teams, auditors, and sales prospects.
• Project Management: Organized and detail-oriented; proven ability to manage multiple concurrent questionnaires and hold engineering teams accountable to fix deadlines.
• Preferred Certifications: CompTIA Security+, CISA, CRISC, or SSCP (or willingness to obtain within first year).

Pay: $65,000.00 - $85,000.00 per year

Benefits:

• 401(k)

Work Location: In person