Security Analyst

Paymentus•Charlotte, NC

20d•Onsite

About The Position

The Information Security GRC Analyst reports to the Director, IT Compliance. The role works across departments to manage compliance readiness, support a central GRC repository, and conduct risk and gap assessments using industry-leading frameworks. It also provides remediation recommendations and tracks progress and related metrics.

Requirements

Working knowledge of risk management, audits (SOC 1, SOC 2, PCI DSS), and information security best practices.
Basic understanding of regulatory compliance and information security frameworks such as GDPR, CCPA, NIST, and CIS Controls.
Experience dealing with internal and external resources across a variety of departments and office hierarchies.
Self-driven, with high attention to detail.
Excellent written and verbal communication skills.
Ability to operate in and maintain a fast pace and cadence.
Authorized to work lawfully in the United States of America.

Nice To Haves

A bachelor's degree and two years of regulatory compliance or similar experience in payments or consumer finance, or a similar combination of education and experience.

Responsibilities

Support audit and compliance activities by gathering evidence, conducting preliminary assessments, and assisting with remediation of audit findings.
Maintain and monitor a central repository of audit evidence.
Conduct gap analyses against industry-standard compliance and regulatory requirements.
Track, update, and draft clear, concise policies, standards, and procedures.
Maintain an up-to-date risk register and track remediation status.
Collaborate with departments on GRC-related objectives.
Track and ensure compliance with IT and security controls across a wide range of regulations.
Follow up with team members to drive progress on tracked issues.
Develop and contribute metrics and KPIs for CISO and executive management review.
Review, update, and test governance plans such as the BCP, IRP, and disaster recovery plans.
Assist in developing and delivering security awareness and training programs on security policies, procedures, and best practices.