Information Security Analyst - GRC & Operations

As the Information Security Analyst, you will support and secure our current and future cyber infrastructure while playing a key role in our Governance, Risk, and Compliance (GRC) program. This hybrid role blends hands‑on security operations with compliance, training, and continuous control assessment responsibilities.

• Secure the organization’s systems and information assets by applying cybersecurity best practices and protecting against unauthorized access, modification, or destruction.
• Partner with end users and department leaders to identify security needs and embed appropriate controls across business units.
• Deploy, integrate, and configure new and existing security solutions in line with standard operating procedures.
• Serve as a Tier 1 responder for cybersecurity alerts and remediations — triage, contain, elevate, document, and investigate problematic or anomalous activity.
• Support vulnerability assessments and penetration testing and coordinate timely remediation of identified weaknesses.
• Administer periodic access reviews to enforce least privilege.
• Support the global cybersecurity compliance program, maintaining alignment with frameworks such as NIST CSF, CIS Controls, ISO 27001, and PCI DSS.
• Perform continuous control assessments, document evidence, identify gaps, and report findings to key stakeholders.
• Maintain the risk register, control catalog, and supporting policies, standards, and procedures; assist with internal/external audits, third‑party risk reviews, and ongoing monitoring.
• Deliver corporate cybersecurity training — new‑hire onboarding, annual refreshers, role‑based training, and phishing simulations.
• Manage training and awareness metrics (completion rates, click/report rates, repeat offenders, behavioral trends), report results to leadership, and coordinate remedial training with HR, IT, and managers.
• Foster a culture of security consciousness across the organization.

• Education:
  
  Bachelor of Science in Cybersecurity or a related field, or equivalent hands‑on experience.
• Experience:
  
  1–2 years of experience or internships in cybersecurity, IT, or GRC — or a strong academic background with relevant projects, certifications, or lab work.
• Frameworks & standards:
  Foundational understanding of common cybersecurity frameworks such as NIST CSF, CIS Controls, ISO 27001, or PCI DSS, and an interest in growing into continuous control assessments and compliance work.
• Security operations & EDR:
  Exposure to endpoint security or EDR tooling and a basic understanding of alert triage, escalation, and incident documentation; willingness to learn Tier 1 response workflows.
• Vulnerability & access management:
  Familiarity with vulnerability scanning concepts, remediation tracking, user access reviews, and least‑privilege principles.
• Risk, policy & audit:
  Awareness of risk management and policy concepts, with an interest in supporting control assessments, evidence collection, and audit activities.
• Security awareness & training:
  Interest in helping build and deliver cybersecurity awareness content (onboarding, annual, phishing simulations) and tracking basic training and phishing metrics.