IT - Security Compliance Analyst II

DESCRIPTION OF ESSENTIAL DUTIES:

• Adhere to, evaluate, and assist in the development of security policies, standards, and procedures; recommend updates to align with legal, regulatory, and business requirements.


• Perform security and compliance assessments to evaluate adherence to internal policies, standards, and applicable regulatory frameworks.


• Assist in identifying control gaps, document findings, and support management and stakeholders in remediation activities.


• Track compliance status, risks, exceptions, and remediation activities, ensuring appropriate documentation and evidence is maintained.


• Assist in internal and external risk assessments, including identifying, analyzing, and documenting security and compliance risks.


• Maintain working knowledge of relevant security and privacy frameworks and regulations (e.g., NIST, CIS, ISO, NAIC, PCI, SOX, HIPAA, or similar, as applicable).


• Assist in delivering guidance and awareness materials to internal teams based on established policies and direction.


• Monitor changes in regulatory requirements, industry standards, and emerging risks, and provide updates to management for review and direction.


• Prepare compliance metrics, status reports, and risk summaries for management review.


• Document activities, assessments, issues, and remediation tracking within designated systems or tools.


• Complete task and project work as assigned.


• Escalates issues, risks, and exceptions to management for review and decision-making.

OTHER RESPONSIBILITIES/REQUIREMENTS:

• Develop and maintain positive working relationships with internal and third-party vendors as needed.


• Provide management and team members with clear, accurate, and timely information regarding compliance posture, risks, and issues.


• Continually improve the security program by identifying gaps in documentation, processes, or controls, and recommending enhancements.


• Demonstrate strong communication and interpersonal skills with the ability to interact effectively with both technical and non‑technical stakeholders.


• Support team members by sharing knowledge of security and compliance practices.


• Ability to follow sound business ethics when executing job responsibilities.


• Demonstrate a commitment to continuous learning and professional development.


• Be a self-motivated individual with the ability to complete assigned tasks and priorities within established timelines, escalating issues or competing demands to management as needed.

QUALIFICATION, EDUCATION AND EXPERIENCE REQUIREMENTS: 

• Bachelor’s degree in Information Technology, Information Security, Risk Management, Business, or a related field, or an equivalent combination of education, training, and experience.


• Background or experience in information security, compliance, governance, risk management, audit, IT operations, or a related discipline is desired.


• Familiarity with developing, maintaining, reviewing, or assessing security policies, standards, and procedures.


• Exposure to security or compliance assessments, risk evaluations, audit support activities, or control testing is beneficial.


• General understanding of IT systems, security controls, and enterprise technology environments.


• Experience working with, interpreting, or mapping controls to recognized frameworks such as NIST CSF, NIST SP 800‑53, CIS Controls, ISO/IEC 27001, or similar.


• Knowledge of regulatory, legal, or contractual security and compliance expectations in regulated or complex environments.


• Security-related professional certifications (e.g., Security+, CISSP, CISA, CISM, CRISC, or similar) are a plus.


• Strong organizational, analytical, and documentation skills with attention to detail.


• Ability to interpret requirements and translate them into clear, practical, and business-aligned guidance.


• Strong written and verbal communication skills, with the ability to engage effectively with both technical and non‑technical stakeholders.


• Demonstrates curiosity and willingness to learn, with interest in understanding the “what,” “why,” and “how” behind security controls and compliance requirements.


• Self-motivated, adaptable, and comfortable working in an evolving security and compliance program.

SUPERVISORY RESPONSIBILITIES:

None

PHYSICAL DEMANDS/WORK ENVIRONMENT:

None

The above statements reflect the general details necessary to describe the principle functions of the occupation described and shall not be construed as a detailed description of all the work requirements that may be inherent in the occupation.