Cybersecurity Analyst

Bertram Capital Management•Colorado Springs, CO

1d•$120,000 - $150,000•Hybrid

About The Position

Bertram Labs, the technology partner to Bertram Capital, is hiring an associate-level Cybersecurity Analyst focused on governance, risk, and compliance (GRC). The analyst will help build and operate the security program against the NIST Cybersecurity Framework (CSF) 2.0 and lead day-to-day work to achieve and maintain SOC 2 compliance. The role also works directly with Bertram Capital portfolio companies to help them meet required security frameworks. The position is suited to someone early in their security career who understands frameworks and brings strong organization, clear communication, and process discipline. The analyst turns framework requirements into policies, controls, evidence, and repeatable workflows, working with Bertram Labs engineers, IT staff, external auditors, business leaders, portfolio company teams, and the CISO. The Cybersecurity Engineer helps determine technical solutions and recommendations; the CISO provides oversight and guides remediation procedures and maturity requirements for portfolio companies. The position is preferred to be based hybrid in Broomfield, Colorado, or Foster City, California. Remote candidates may also be considered from California, Colorado, Idaho, Minnesota, Illinois, Massachusetts, Florida, New York, Wisconsin, Texas, Arizona, Indiana, or Ohio.

Requirements

0–3 years of experience in information security, GRC, IT audit, risk, or IT operations; internships and relevant academic projects count.
Bachelor's degree in cybersecurity, information systems, computer science, or a related field, or equivalent practical experience.
Working knowledge of at least one major security framework: NIST CSF, NIST SP 800-53, ISO/IEC 27001, or CIS Controls, including how controls map between frameworks.
Basic understanding of SOC 2, including the Trust Services Criteria and the difference between Type I and Type II reports.
Exceptional organizational skills and the ability to track many open items across multiple owners without losing track of them.
Clear written and verbal communication, including the ability to explain security requirements to non-technical leaders.
A process-oriented approach, including documenting processes and making them repeatable.
Comfort with core IT concepts, including identity and access management, endpoints, networks, and cloud services.

Nice To Haves

Relevant certifications such as ISC2 CC, CompTIA Security+, ISACA CISA, or ISC2 CGRC.
Hands-on involvement in a SOC 2, ISO/IEC 27001, or similar audit, on the company or auditor side.
Strong Excel or Google Sheets skills for building and maintaining compliance trackers.
Exposure to compliance automation platforms such as Vanta, Drata, or similar.
Familiarity with AWS, Azure, or Google Cloud, and Microsoft 365 or Google Workspace security settings.
Experience with ticketing and project tools such as Jira, monday.com, or similar.

Responsibilities

Maintain NIST CSF 2.0 Current and Target Profiles, track gaps across all six Functions, and take particular ownership of Govern (GV).
Draft, update, and manage review cycles for information security policies, standards, and procedures.
Maintain the risk register, documenting risks, owners, treatment decisions, and due dates, and follow up until items are closed.
Map controls across NIST CSF, SOC 2, CIS Controls, and ISO/IEC 27001 frameworks.
Manage Bertram vendor third-party due diligence by collecting and analyzing security questionnaires, SOC reports, policies, and certifications, then submitting an analysis summary to the CISO for approval or rejection.
Own the security baseline for each portfolio company; support implementation of the CISO's initial post-acquisition analysis, transition it into the company's baseline, and conduct recurring baseline reviews.
Work with portfolio company leadership and IT teams to assess and track compliance with required frameworks.
Conduct framework gap assessments and help develop practical remediation plans for portfolio companies.
Manually collect portfolio company compliance data and evidence, track status and open remediation items, and report progress to Bertram Labs leadership.
Share policy templates, control guidance, and best practices with portfolio companies.
Help each portfolio company establish its own third-party vendor due diligence program, including processes, templates, and review criteria.
Coordinate SOC 2 readiness, the Type I audit, and ongoing Type II audit periods against the AICPA Trust Services Criteria.
Own the SOC 2 control inventory and evidence calendar, tracking what evidence each control needs, who provides it, and when.
Collect, organize, and quality-check audit evidence, and manage auditor requests through closure.
Track exceptions and remediation items with control owners until they are fixed and re-tested.
Build and maintain the evidence tracker and repository manually using spreadsheets and shared drives; the company does not use an automated compliance platform.
Run recurring control activities, including access reviews, security awareness training, policy attestations, and tabletop exercises.
Translate framework language into plain-English requirements for engineers and business staff.
Regularly report compliance status, open risks, and audit progress to Bertram Labs leadership.
Collect evidence for the CISO's responses to investor (LP) due diligence questionnaires and other security questionnaires.
Support incident response documentation and post-incident reviews as needed.
Perform other duties and projects as assigned.