Information Security Analyst

Responsibilities:

• Support the operation and continuous improvement of the Information Security Management System, ISO 27001 and SOC 2-style controls, and customer/internal compliance requirements.
• Maintain security policies, standards, control documentation, and compliance trackers; translate customer contracts and security addenda into internal controls.
• Coordinate audit evidence collection for internal, external, surveillance, and customer-led audits; track findings and remediation through closure.
• Support periodic risk assessments and help maintain the enterprise risk register.
• Track key security metrics (vulnerability remediation, training completion, vendor risk, and compliance maturity) and prepare updates for leadership and Security Council reviews.
• Support responses to customer security questionnaires, RFP/RFI security sections, and due-diligence requests; coordinate customer audits and walkthroughs.
• Execute third-party risk management vendor due-diligence reviews, risk ratings, remediation tracking, and periodic reassessments of critical vendors.
• Coordinate security awareness initiatives, including onboarding and refresher training, phishing simulations, and role-based awareness content.
• Maintain audit-ready documentation and identify opportunities to automate evidence collection, compliance tracking, and reporting workflows.

Requirements:

• 3-4 years of experience in information security, GRC, IT risk, compliance, audit, or related roles.
• Hands-on experience with ISO 27001 SOC 2-style controls, internal/external audits, and customer security assessments.
• Experience performing or supporting security audits, IT risk assessments, or control testing; a Big 4 or similar audit/advisory background is a strong fit.
• Experience in vendor risk management, third-party due diligence, and contract security reviews.
• Ability to respond to customer security questionnaires, RFP/RFI security sections, and due diligence requests.
• Good understanding of access control, vulnerability management, secure SDLC, incident management, data protection, and cloud security.
• Strong documentation, coordination, and follow-up skills; comfortable working across engineering, product, DevOps, IT, HR, procurement, legal, and customer success.
• Strong ownership mindset, able to drive tasks to closure without frequent follow-up

Preferred Qualifications:

• Certifications such as ISO 27001 Lead Implementer, ISO 27001 Lead Auditor, CISA, CISM, CRISC, Security+, or CISSP.
• Experience working in SaaS, fintech, AI/technology, financial services, or customer-audited environments.
• Familiarity with frameworks such as NIST CSF, NIST 800-53 CIS Controls, ISO 27001 Annex A, OWASP, and cloud security benchmarks.
• Experience using GRC platforms, ticketing tools, document repositories, vendor risk tools, and dashboard/reporting tools.
• Certifications such as ISO 27001 Lead Implementer, ISO 27001 Lead Auditor, CISA, CISM, CRISC, Security+, or CISSP.
• Experience working in SaaS, fintech, AI/technology, financial services, or customer-audited environments.
• Familiarity with frameworks such as NIST CSF, NIST 800-53 CIS Controls, ISO 27001 Annex A, OWASP, and cloud security benchmarks.
• Experience using GRC platforms, ticketing tools, document repositories, vendor risk tools, and dashboard/reporting tools.