Information Security and Compliance Analyst

Job Title: Information Security and Compliance Analyst
Introduction
Reporting to the IT Security and Compliance lead, the person in this role will support our Information Security Management System and be instrumental in driving and organizing our ongoing SOX and ISO 27001 compliance efforts. This person will help analyze and track vulnerability findings and conduct vulnerability management efforts. The Ideal candidate will have exceptional written communication skills and the ability to manage complex documentation and audit requests. We are looking for a person with a passion for ensuring security best practices are followed consistently across the organization.
What You’ll Be Doing and the Impact You’ll Make:
Coordinate and track SOX and ISO 27001 compliance efforts, including control reviews, evidence collection, process documentation, and internal readiness assessments
Experience with security configuration and knowledge of cloud service administration including AWS and Azure
Organize and conduct comprehensive searches to determine the applicability of data security policies to client contracts
Serve as the point of contact for auditors and internal stakeholders during compliance reviews, ensuring clear and timely communication
Maintain and organize a central repository of compliance documentation, policies, and procedures with a high standard of clarity and accuracy
Review, triage, and analyze vulnerability findings from internal scans and external tools; prioritize and categorize based on risk and potential business impact.
Work closely with IT and application owners to coordinate remediation efforts, follow up on open vulnerabilities, and ensure timely resolution
Assist in developing security policies, procedures, and user guidance aligned with industry best practices
Generate concise and meaningful reports and dashboards for internal leadership and auditors
Track exceptions, manage control gaps, and help drive risk mitigation strategies
Contribute to security awareness and training efforts by preparing clear documentation and guidance materials