Sr. Analyst, IT Security, Risk & Compliance

## Sr. Analyst, IT Security, Risk & Compliance
** Irvine,CA92606
*
* Employment Type:

Perm Job Number: 25881

Remote Options:
Hybrid##

Job Description Sr. Analyst, IT Security, Risk & Compliance  
** Irvine, CA | Hybrid – 2 days/week onsite | $125K–$135K + 10% bonus
** We’re looking for a
** hands-on IT Security, Risk & Compliance professional
** to join a fast-growing, consumer-focused company that is actively building and maturing its security program.
This is a great opportunity for someone who wants
** real ownership and impact**. The security/GRC framework is being built today, so you’ll have the opportunity to come in during the implementation phase and help turn the framework into a practical, operational security program.  What You’ll Do
* Own the
** day-to-day operation and execution
** of the IT security and GRC program.
* Operate and maintain the company’s
** ISMS, security controls, risk register, compliance activities and control calendar**.
* Coordinate and execute
** control testing, access reviews, assessments and audit-readiness activities**.
* Gather and validate audit evidence, maintain documentation and drive findings through remediation and closure.
* Investigate and coordinate the response to
** security incidents, vulnerabilities, access issues and security findings**.
* Work closely with internal stakeholders, third-party security partners, vendors and the company’s global parent organization.
* Develop and maintain security policies, SOPs, playbooks, control narratives and other security documentation.
* Track security awareness, phishing education, compliance activities, remediation and overall security program health.
* Identify opportunities to improve and mature the security program over time.

What They’re Looking For
* ** 5+ years
** of experience in IT Security, GRC, Information Security, Security Compliance or a related area.
* Hands-on experience with
** security controls, audits, risk assessments, compliance, remediation and control testing**.
* Experience with one or more frameworks such as
** ISO 27001, NIST, SOC 2 or SOX ITGC**.
* Strong understanding of
** Microsoft 365, Entra /Azure AD, endpoint management, IAM, cloud security and security operations**.
* Experience investigating or coordinating
** security incidents and vulnerability remediation**.
* Strong documentation, organization, communication and follow-through skills.
* Someone who can
** work independently, navigate ambiguity and figure things out without needing constant direction**.Why This Opportunity?  This isn't a role where you'll simply maintain someone else's mature security program.
The company is
** actively building its security/GRC framework**, giving you the opportunity to help establish how the program operates, take ownership of the controls and processes, and play a meaningful role in its continued maturity.
You'll also work in a
** highly cloud-based, technology-driven environment
** with significant exposure to third-party technology and security partners and a global parent organization.
If you're a security/GRC professional who enjoys
** ownership, problem-solving and building something rather than simply maintaining it**, this could be an excellent opportunity.