Information Security Analyst

NEPC, LLC•Boston, MA

9h•$80,500 - $106,600•Remote

About The Position

The Information Security Analyst is a role reporting to the Director of Information Security and focused primarily on security operations, investigations, and vulnerability follow-through, with secondary responsibility for governance and operational risk coordination. The analyst works across security tools and business processes to identify issues, investigate activity, document findings, and drive remediation with IT and other stakeholders. This role is responsible for monitoring and investigating alerts and vulnerabilities, coordinating response and remediation efforts, maintaining clear documentation, and supporting core security governance activities such as the risk register, committee records, and audit evidence. Success in this role requires strong judgment, disciplined procedure-following, clear communication, and the ability to work independently while collaborating across technical and non-technical teams.

Requirements

3–5 years of working experience in information security, IT Infrastructure, systems administration, networking, and/or technical support.
Working knowledge of and experience with security operations activities such as alert triage, vulnerability tracking, investigation workflows, escalation, and documentation.
Proficiency using security and IT tools such as endpoint protection, vulnerability management platforms, SIEM, ticketing systems, dashboards, and related technologies.
Strong written and verbal communication skills across teams with different technical and operational backgrounds.
Ability to follow procedures carefully, improve documentation where needed, and manage work with minimal supervision.
Sound judgment, attention to detail, and the ability to prioritize effectively when handling multiple issues.

Nice To Haves

Additional audit, compliance, or risk-related experience is helpful.
Relevant certifications may include Security+, CySA+, ISC2 entry-level certifications, GSEC, or similar information security, audit, or risk-related certifications.
Familiarity with CIS Controls, NIST, CISA publications, and related standards is helpful.

Responsibilities

Monitor, investigate, and triage alerts, events, vulnerabilities, and escalated helpdesk tickets across the security stack; Understanding potential impact and distinguishing meaningful threats from false positives or low-risk activity.
Coordinate with IT, Business Analysts, process owners, and other stakeholders to drive remediation, containment, follow-up, and closure of security and operational risk issues.
Document investigative steps, evidence, decisions, remediation progress, and outcomes in a clear, consistent, and repeatable manner; identify recurring issues, process gaps, and broader trends, and escalate them appropriately.
Support vulnerability management activities, including scan coordination, review of findings, remediation tracking, follow-up on overdue items, and validation of progress against defined timelines.
Maintain the risk register, including risk descriptions, owners, mitigation plans, status updates, and supporting records, and work alongside Business Analysts and process owners to identify and document operational risks, control gaps, and dependencies revealed through incidents, investigations, or project work.
Assist with Operational Risk Council activities by preparing materials, tracking action items, and maintaining meeting records, and organize documentation and evidence needed for audits, regulatory requests, and internal reviews.
Partner with the Compliance team to support security and privacy requirements related to client contractual obligations, Regulation S-P, and emerging technology use cases.
Support security procedures, policy updates, and awareness efforts by helping keep documentation current and identifying useful communication or training opportunities based on trends and observed issues.