Security Risk & Compliance Analyst

About the role

Our client is seeking a Security Risk & Compliance Analyst in the United States for a fully remote role. You will work within a collaborative Information Security team to strengthen cybersecurity governance, manage enterprise risk, and help the organization stay aligned with regulatory and internal compliance expectations. The position is well-suited to someone who enjoys combining strategic oversight with practical risk analysis and process improvement.

This opportunity is being handled by a partner company, which will review applications and manage the next steps in the hiring process.

Key responsibilities

• Run IT and cybersecurity risk reviews across systems, applications, and business workflows to spot, assess, and reduce exposure.
• Own and improve the centralized IT risk register, monitor remediation progress, and work with stakeholders to close identified gaps.
• Support and drive audit-preparedness work for controls and regulations such as SOC 2, HIPAA, NYDFS, and internal compliance programs.
• Coordinate policy management activities, including periodic reviews, compliance tracking, and recommendations that strengthen governance.
• Carry out third-party security assessments and evaluate risks tied to vendors, suppliers, and other business partners.
• Create dashboards, reports, and key risk indicators to give leadership clear visibility into the current security posture.
• Contribute to security awareness efforts, compliance training, and ongoing improvement initiatives across the organization.

Requirements

• At least 5 years of experience in information security, cybersecurity governance, IT risk, auditing, or compliance-related work.
• Strong grasp of cybersecurity fundamentals, security controls, IT infrastructure, and data protection practices.
• Hands-on familiarity with frameworks such as NIST, CIS Controls, or ISO 27001.
• Working knowledge of regulatory and privacy standards such as HIPAA, NYDFS, CCPA, or similar requirements is strongly preferred.
• Exposure to GRC platforms such as OneTrust, LogicGate, ServiceNow GRC, or TeamMate is preferred.
• Experience with third-party risk tools such as SecurityScorecard or BitSight is an added advantage.
• Comfort using Microsoft Excel, PowerPoint, SharePoint, Teams, and related collaboration tools.
• Strong analytical, organizational, communication, and stakeholder-management abilities, with the capacity to juggle multiple priorities.
• Professional certifications such as Security+, CISA, CRISC, or ISO 27001 Foundations are a plus.

Benefits

• Annual compensation in the range of $120,000 to $140,000, depending on experience and qualifications.
• Eligibility for a performance-based bonus.
• Fully remote setup, with preference for applicants in the Central or Eastern U.S. time zones.
• Medical, dental, and vision insurance coverage.
• Life insurance and disability benefits.
• 401(k) retirement savings plan.
• Generous paid time off.
• The chance to join a collaborative Information Security team focused on continuous improvement and professional development.

Additional information

This role is based in the United States and is fully remote. The hiring partner manages applications, candidate review, and the subsequent hiring stages. The recruitment process may use AI-assisted tools to help review applications and supporting materials, but final decisions are made by people. By applying, candidates acknowledge that personal data may be processed for recruitment purposes and shared with the hiring employer, with rights available for access, correction, deletion, and objection where applicable.