Information Security Analyst

What You’ll Do

● Support the operation and continuous improvement of the Information Security Management System — ISO 27001, SOC 2-style controls, and customer/internal compliance requirements.

● Maintain security policies, standards, control documentation, and compliance trackers; translate customer contracts and security addendums into internal controls.

● Coordinate audit evidence collection for internal, external, surveillance, and customer-led audits; track findings and remediation through closure.

● Support periodic risk assessments and help maintain the enterprise risk register.

● Track key security metrics (vulnerability remediation, training completion, vendor risk, compliance maturity) and prepare updates for leadership and Security Council reviews.

● Support responses to customer security questionnaires, RFP/RFI security sections, and due-diligence requests; coordinate customer audits and walkthroughs.

● Execute third-party risk management — vendor due-diligence reviews, risk ratings, remediation tracking, and periodic reassessments of critical vendors.

● Coordinate security awareness initiatives, including onboarding and refresher training, phishing simulations, and role-based awareness content.

● Maintain audit-ready documentation and identify opportunities to automate evidence collection, compliance tracking, and reporting workflows.

What We’re Looking For

● 3-4 years of experience in Information Security, GRC, IT Risk, Compliance, Audit, or related roles.

● Hands-on experience with ISO 27001, SOC 2-style controls, internal/external audits, and customer security assessments.

Experience performing or supporting security audits, IT risk assessments, or control testing — Big 4 or similar audit/advisory background is a strong fit.

● Experience in vendor risk management, third-party due diligence, and contract security reviews.

● Ability to respond to customer security questionnaires, RFP/RFI security sections, and due-diligence requests.

● Good understanding of access control, vulnerability management, secure SDLC, incident management, data protection, and cloud security.

● Strong documentation, coordination, and follow-up skills; comfortable working across Engineering, Product, DevOps, IT, HR, Procurement, Legal, and Customer Success.

● Strong ownership mindset — able to drive tasks to closure without frequent follow-up.

Preferred Qualifications

● Certifications such as ISO 27001 Lead Implementer, ISO 27001 Lead Auditor, CISA, CISM, CRISC, Security+, or CISSP.

● Experience working in SaaS, fintech, AI/technology, financial services, or customer-audited environments.

● Familiarity with frameworks such as NIST CSF, NIST 800-53, CIS Controls, ISO 27001 Annex A, OWASP, and cloud security benchmarks.

● Experience using GRC platforms, ticketing tools, document repositories, vendor risk tools, and dashboard/reporting tools.