Information Technology Security Analyst

Role Summary The Information Security Governance, Risk and Compliance Analyst supports execution of the Governance, Risk and Compliance program across the US affiliate. Reporting to the Senior Manager, Information Security Governance Risk and Compliance, this role is responsible for performing information security risk assessments, third-party security reviews, policy administration, control assurance, compliance support, remediation tracking, and operational reporting. The position works closely with IT, Legal, Privacy, Procurement, Quality, Internal Audit, business stakeholders, and Global Information Security to ensure information security risks are identified, documented, communicated, and managed in alignment with enterprise requirements.

This role contributes to the development of repeatable governance, audit readiness, and risk management capabilities as the US Information Security function continues to mature. The successful candidate will bring strong analytical judgment, attention to detail, and the ability to translate risk and control information into clear documentation that supports informed decision making.

Primary Responsibilities

• Perform information security risk assessments across applications, infrastructure, business processes, projects, and third parties
• Support maintenance of the US information security risk register, risk treatment plans, remediation status, and supporting evidence
• Execute third-party security reviews and vendor risk assessments in partnership with Procurement, Legal, Privacy, and business stakeholders
• Support lifecycle management of information security policies, standards, procedures, guidelines, attestations, and exceptions
• Collect, validate, and organize compliance and control evidence for internal audits, external audits, regulatory inspections, and assurance activities
• Track remediation plans and coordinate follow-up activities with risk owners, control owners, and cross-functional stakeholders
• Support control assessments and control effectiveness reviews against information security policies, standards, and regulatory requirements
• Maintain governance, risk, and compliance documentation, repositories, metrics, dashboards, and reporting artifacts to support management visibility
• Assist with preparation of executive reporting materials, governance committee content, and risk review documentation
• Identify opportunities to improve GRC processes through standardization, automation, documentation quality, and repeatable workflows

Education and Required Skills

• Minimum of 3 years of experience in information security, cybersecurity governance, IT risk management, compliance, audit, or related disciplines
• Bachelor’s degree preferred in Cybersecurity, Information Technology, Information Systems, Business, Risk Management, or a related field
• Working knowledge of cybersecurity and risk frameworks such as NIST CSF 2.0, ISO 27001, CIS Controls, PCI, SOX, FAIR, or similar standards
• Experience supporting risk assessments, compliance reviews, audits, control assurance, third-party reviews, or remediation tracking
• Strong written communication skills with the ability to develop clear documentation, reports, procedures, and stakeholder-ready materials
• Strong analytical and organizational skills with attention to detail and the ability to manage multiple priorities

Relevant certifications such as Security+, GSEC, SSCP, CISA, CRISC, or similar certifications preferred.

Travel and Location

• Estimated travel required: 0-5%
• On-site in Boston preferred 1-2 days hybrid or 100% remote with occasional travel to Boston