Security Analyst

Avant Communications LLC•Chicago, IL

14h•Hybrid

About The Position

Avant is seeking a hands-on Security Analyst in the Technology department to own the organization's day-to-day security posture across employees, endpoints, software, vendors, and emerging AI risks. The position combines security governance with technical security operations, including assessing exposure, reviewing controls, evaluating vendors and software, and determining whether security measures hold up under testing. The role is based in Chicago and is described as hybrid/remote. Employees in the Greater Chicagoland Area or Dallas/Frisco area are currently expected to work in the office one day per week; this arrangement is subject to change. The role reports to the VP of IT. The Security Analyst will maintain security visibility and controls, assess third-party and AI-related risks, coordinate vulnerability scanning and penetration testing, support incident response, and maintain the security program in alignment with relevant frameworks and privacy regulations. The position also contributes to policies, audit readiness, and leadership reporting.

Requirements

At least 4 years of experience in information security, GRC, or a senior analyst role.
Working knowledge of NIST, ISO 27001, GDPR, and CCPA/CPRA requirements.
Familiarity with vulnerability scanning tools such as Nessus, Qualys, or Tenable.
Familiarity with penetration testing methodology, whether working with an internal team or managing external testers.
Familiarity with Security Operations Center functions and working with an MSSP to mitigate and remediate events.
Experience with endpoint management/MDM tools and understanding of laptop and device security controls.
Familiarity with SaaS and vendor risk assessment processes.
Emerging understanding of AI security risks and governance, including risks from generative AI and AI-embedded tools.
Strong communication skills and ability to translate technical risk into business terms for non-technical stakeholders.
Ability to balance policy and governance work with hands-on technical review.

Nice To Haves

Relevant certifications such as CISSP, CISM, Security+, GSEC, CEH, or similar.
Experience building or maturing an early-stage security program.
Prior experience in a regulated industry, such as finance or healthcare.

Responsibilities

Monitor employee security practices, device compliance, and adherence to internal security policies.
Maintain visibility into laptops, mobile devices, and endpoints, including encryption, EDR/antivirus coverage, and configuration drift.
Manage identity and access controls, including least privilege, MFA, offboarding, and privileged access reviews.
Run security awareness training and phishing simulations.
Maintain an inventory of software and SaaS tools, including unsanctioned shadow IT applications.
Evaluate and approve new software and AI tools, assessing data handling, permissions, and vendor risk.
Track license and application sprawl as a security issue.
Monitor AI-specific risks, including prompt injection, data leakage, vendor data retention, unsanctioned generative AI use with sensitive data, and AI supply-chain risk.
Co-develop and enforce acceptable-use policies for AI tools and copilots.
Assess AI vendors and AI features embedded in existing software for security implications.
Conduct vendor security assessments and due diligence before and during engagements.
Review vendor security documentation, including SOC 2 reports, ISO 27001 certifications, penetration test summaries, and security questionnaires.
Maintain a third-party risk register and reassess vendors periodically based on criticality and data access.
Coordinate or perform vulnerability scanning across infrastructure, endpoints, and applications.
Manage or oversee penetration testing engagements and track findings through remediation.
Perform cyber risk assessments across systems, business units, and processes.
Support incident response, including detection, triage, containment, and post-incident review.
Maintain and mature the security program in alignment with frameworks such as NIST CSF/800-53, ISO 27001, and SOC 2.
Ensure practices support compliance with GDPR and CCPA/CPRA.
Own or contribute to security policies, standards, and audit readiness.
Report security posture, risk, and metrics to leadership.