Cybersecurity Compliance Analyst (Hybrid - Bay Area)

Xantrion • Lafayette, CA

6d • Hybrid

About The Position

Xantrion is seeking a Cybersecurity Compliance Analyst to support our Compliance Service offering and internal compliance programs. You will help assess client security controls, develop practical compliance documentation, evaluate vendor cybersecurity risk, and organize evidence that supports client requirements. This role combines technical IT knowledge with strong analytical and writing skills to support our Client Strategy team across a diverse client base. The team leads client assessments, executive discussions, and remediation planning, while you provide supporting analysis and produce accurate, well-organized deliverables using established templates, standards, and guidance.

Requirements

• Three or more years of combined experience in IT operations, cybersecurity, IT audit, or compliance, including at least one year supporting control assessments, audit evidence collection, or security documentation.
• Practical understanding of business IT environments, including identity and access management, endpoint security, email security, backups, networking, and cloud services.
• Experience reviewing technical configurations or administrative reports against documented standards.
• Working knowledge of NIST CSF and CIS Controls, with familiarity with NIST SP 800-53 and ISO/IEC 27001 control concepts.
• Strong writing skills and the ability to produce clear, accurate policies, procedures, assessment findings, and client documentation.
• Ability to distinguish documented policies from evidence that controls are implemented and operating.
• Strong organization, attention to detail, and the ability to manage deliverables across multiple clients.
• Ability to work independently on assigned tasks, identify questions or evidence gaps, and incorporate vCIO feedback.
• Professional communication skills and sound judgment when handling confidential client information.
• Must have an existing cell phone (running current Android or iOS).
• When Working Remote: Must have a reliable, high-speed internet connection that effectively supports work responsibilities, including video conferencing.
• When Working Remote: Must have a dedicated, secure, and private workspace. Unless arranged by Xantrion, shared work environments, such as coworking spaces, are unacceptable.
• Client information must always be kept private.
• Must use Xantrion-provided PC and headset to execute job functions.

Nice To Haves

• Experience supporting registered investment advisers (RIAs) or other financial services organizations.
• Familiarity with cybersecurity and information protection requirements relevant to financial services, including SEC Regulation S-P, the FTC Safeguards Rule under GLBA, and applicable FINRA requirements.
• Experience working for a managed service provider or supporting multiple client environments.
• Hands-on familiarity with Microsoft 365, Entra ID, Intune, and common endpoint and security management tools.
• Experience conducting vendor cybersecurity reviews and evaluating SOC 2 reports.
• Experience supporting SOC 2 Type II examinations or ISO/IEC 27001 audits.
• Familiarity with additional requirements and programs such as HIPAA, CJIS, NIST SP 800-171, CMMC, or FedRAMP.
• Relevant certifications, such as Security+, CGRC, CISA, or an ISO/IEC 27001 credential.
• A relevant degree or certification is welcome but is not required. Equivalent practical experience will be considered.

Responsibilities

• Support current-state and target-state cybersecurity assessments using NIST Cybersecurity Framework (CSF), CIS Controls, and Xantrion standards.
• Review IT configurations and supporting evidence against established templates and control requirements; document gaps and findings for virtual Chief Information Officer (vCIO) review.
• Draft and maintain incident response plans (IRPs), business continuity plans (BCPs), written information security programs (WISPs), and supporting security policies and procedures.
• Support business impact analyses, risk and gap assessments, cybersecurity risk registers, and risk-acceptance records.
• Prepare control crosswalks, prioritized remediation roadmaps, executive risk summaries, and reporting scorecards under vCIO direction.
• Conduct vendor cybersecurity risk reviews by evaluating questionnaires, audit reports, security documentation, and supporting evidence.
• Maintain software and vendor inventories, data inventories, data flow documentation, and evidence indexes.
• Maintain annual testing schedules and track documentation, review dates, and follow-up items.
• Translate technical findings into clear descriptions of risk, supporting evidence, and recommended actions.
• Improve reusable templates and assessment procedures that support consistent delivery across clients.
• Coordinate evidence collection and auditor requests for Xantrion’s annual SOC 2 Type II examination and ISO/IEC 27001 audit activities.
• Organize audit documentation, maintain request trackers, and follow up with internal control owners.
• Review evidence for completeness and consistency and identify missing or outdated documentation.
• Provide seasonal support during internal audit preparation and review periods.

Benefits

• Salary range $100-120K; depending on experience.
• 100% of medical, dental, and vision for you and your family.
• 401K with company match up to 4% of salary.
• Certification reimbursement and annual training budget.
• 17 Days PTO per year in addition to paid training days.
• Bonuses for referring new clients or employees.
• If applicable Xantrion will provide a cell phone, internet connection, and home office equipment allowance.

What This Job Offers

• Job Type: Full-time
• Career Level: Mid Level
• Education Level: No Education Listed