The Information Security Analyst - Audit and Compliance is responsible for maintaining policies, procedures and standards across the Enterprise to ensure the implementation and ongoing maintenance of enterprise-wide Risk, Data & Compliance; Data Governance; and Application Security Programs. This individual contributor will also answer vendor and client security assessments, and perform regularly scheduled control testing across all SaaS and custom-developed applications. The position works with internal and external stakeholders to address gaps escalating issues when needed to team members or management.

Duties and Responsibilities:

Works with Security leadership to create or modify policies and procedures related to Information Security, Data Privacy, Data Governance, and Risk Management.
Works with Security leadership in the preparation, categorization, selection, implementation, assessment, authorization, and monitoring of risks across the enterprise.
Review application development, data management, and identity & access process documentation for accuracy and compliance with policies, internal controls and audit requirements.
Works with internal stakeholders to create and maintain repeatable processes, flow charts, and procedures to ensure compliance.
Works with Marketing, Sales, and Product teams to complete client security assessments.
Performs in all activities of Certification and Accreditation (C&A) / Assessment and Authorization (A&A) efforts for information systems, networks, and site accreditations.
Conduct testing of Security Controls for SOC-2 to identify and evaluate risk exposures and determine the effectiveness of controls.
Create and maintain open findings and gap reports, and lead remediation efforts.
Main Security Point of Contact for new and existing IT and Business projects to ensure Security Review is completed for all new enterprise initiatives.
Other tasks as requested by Information Security leadership.

Required Education and Experience:

Minimum 2-4 years experience in Cybersecurity risk, audit and compliance or a related technology field.

AA or AS degree in Computer Science, Information Systems, Cybersecurity, or a related field.
Excellent analytical skills reflected in receiving information from internal and external stakeholders, processing it, and applying standards and requirements to it with the goal of producing an effective assessment of compliance.
Demonstrated effectiveness in producing and maintaining technical documentation.
Demonstrated knowledge of NIST Risk Management framework, Audit and Compliance, Data Governance, and/or Application Security in support of a holistic enterprise security posture.
Demonstrated knowledge of information security concepts and processes such as security control techniques and technologies, assessment and evaluation methods, and user access control methodologies.
Background in Information Security, Systems Administration, and Information Technology.
Background in Public Cloud Infrastructure Expertise (GCP, AWS or Azure).
Full-stack knowledge of IT infrastructure, from applications & databases to hypervisors and networking.
Background in Linux/Windows/macOS System Administration
Clear understanding of software development/build processes.
A thirst for knowledge and self-improvement.

SSCP or CompTIA Security+ certified professionals preferred.

Position Type/Expected Hours of Work:

This is a full-time position and hours of work and days vary Monday through Friday from 9:00 am to 5:00 pm. Occasional evening and weekend work may be required, as needed.

ScribeAmerica

New Jobs

Information Technology Security Analyst