IT Security and Compliance Analyst

Lima One Capital•Greenville, SC

12d•Onsite

About The Position

The IT Security & Compliance Analyst is a technically skilled member of Lima One Capital's Information Security & Compliance team. The role combines day-to-day security operations with SOX IT General Controls (ITGC) execution, audit support, and access governance. The analyst helps protect the company’s environment, ensure controls operate effectively, and keep evidence audit-ready. The position works alongside the existing security team and reports directly to the Vice President of Information Security & Compliance.

Requirements

At least 5 years of experience in Information Security, Security Operations, GRC, or IT Audit, including hands-on technical security work.
Strong hands-on experience with Microsoft Defender (Endpoint, Office 365, Identity, and/or Cloud Apps), including alert investigation and advanced hunting with KQL.
Working experience with Microsoft Purview, including DLP, sensitivity labels, audit, retention, or eDiscovery, and Microsoft 365 security and compliance tooling.
Strong knowledge of Microsoft Entra ID and identity and access management concepts, including Conditional Access, MFA, and privileged access.
Demonstrated experience with security incident monitoring, investigation, and response.
Experience with vulnerability management processes, including prioritization and remediation tracking.
Hands-on experience supporting SOX IT General Controls, including evidence collection and control testing.
Experience conducting user access reviews and reviewing change management controls.
Strong written and verbal communication skills, including the ability to produce clear, audit-quality documentation and brief senior leadership.
Ability to work independently, manage competing priorities, and exercise sound judgment in an audit-driven environment.

Nice To Haves

Experience in financial services, banking, lending, or another regulated industry.
Internal or external audit support experience and familiarity with working directly with external auditors.
Experience with Microsoft Sentinel or another SIEM platform, plus Azure, Active Directory, and Intune.
Scripting and automation experience, preferably PowerShell, for security operations, evidence collection, and reporting.
Experience with security automation and orchestration, such as Defender automated investigation and response, Logic Apps, or similar.
Experience assessing and governing AI tools and features, including AI risk assessments, acceptable use, vendor AI reviews, and data handling and privacy considerations.
Familiarity with securing generative AI tools, including data oversharing risk, sensitivity labels, and Purview DLP controls.
Working knowledge of AI governance and risk frameworks such as the NIST AI Risk Management Framework or ISO/IEC 42001.
Experience using AI-assisted tools responsibly to improve security analysis, detection, or compliance workflows.
Relevant certifications, such as Microsoft SC-200, SC-300, SC-401, or AZ-500; CompTIA Security+ or CySA+; CISA, CISSP, or CRISC; or AI governance credentials such as IAPP AIGP or ISACA AAIA.

Responsibilities

Monitor, triage, and investigate alerts and incidents across Microsoft Defender products and related security platforms.
Perform threat hunting and incident analysis using KQL advanced hunting queries and log correlation; determine scope, root cause, and impact.
Escalate critical incidents to the VP of Information Security & Compliance and support containment and remediation with IT teams.
Tune detection rules, alert policies, and automated responses to reduce noise and improve signal quality.
Maintain incident documentation and case tracking; contribute to incident response playbooks, runbooks, and tabletop exercises.
Review and tune Microsoft Purview controls, including DLP policies and alerts, sensitivity labels, retention, audit logging, and eDiscovery support.
Review Microsoft Entra ID security posture, including Conditional Access, Identity Protection risk signals, and privileged access configuration.
Assess security configuration and compliance posture across Microsoft 365, Intune-managed endpoints, and Azure; document gaps and track them to closure.
Review vulnerability scan and penetration test results and track remediation to closure.
Prioritize vulnerability findings based on risk, threat intelligence, and asset criticality; coordinate resolution with system owners and IT teams.
Report on vulnerability trends, aging items, and SLA adherence.
Execute assigned ITGCs and maintain evidence supporting control operation.
Assist with quarterly and annual control testing and audit readiness activities.
Gather audit artifacts, coordinate requests across IT teams, and support internal and external auditors.
Track control exceptions and audit findings through remediation and maintain an organized, audit-ready evidence repository.
Review change management records and logs; validate approvals and supporting documentation.
Perform IT ticket quality and compliance reviews, identify process exceptions, control gaps, and recurring trends, and recommend corrective actions.
Identify opportunities to simplify and improve control execution and evidence collection.
Recommend process and configuration improvements to the VP of Information Security & Compliance and system owners.
Produce monthly operational reports, track cybersecurity and compliance KPIs, and support executive reporting and compliance and audit-readiness dashboards.

Benefits

Medical, dental, and vision insurance.
Life insurance and short-term and long-term disability insurance.
Hospitalization and accidental insurance.
Flexible Spending Accounts for health and dependent care.
Health Savings Account.
Safe Harbor 401(k) with company match.
Growing Families Support, including paid parental leave, infertility support and assistance, childcare reimbursement, and elder care.
Pet insurance.
12 paid time off days, 5 sick days, and 12 paid holidays.
Continuous learning opportunities, dedicated mentorship, and career development.
Paid parking at the company's new downtown Greenville office.