Security and Compliance Analyst II

Lasso Informatics Inc Lasso Informatique Inc•Montreal, QC

4d•CA$78,000 - CA$114,000•Remote

About The Position

As a Security and Compliance Analyst at Lasso, you own the weekly security and compliance work behind a health research data platform running on AWS and Google Cloud. You review cloud and identity logs, triage vulnerabilities, keep our audit evidence current in Vanta, and help take the company through SOC 2 Type 2. You also run Lasso's AI governance execution work. This position sits under the Manager of Security, Compliance and DevOps, with oversight from the CTO, COO and CEO as appropriate. We are a HIPAA Business Associate running to a NIST 800-53 Moderate control baseline, and a federal sponsor checks our work continuously. The security team is one person today. You would be the second, and getting us certified is a real piece of the job, not a side project. As the role matures, this person may be designated Information System Security Officer (ISSO) for our NIST 800-53 authorization boundary, working under the Security Officer.

Requirements

Three or more years in security, compliance, audit, information technology or systems administration, where you produced evidence that someone else then inspected.
A current CompTIA Security+, SSCP, GSEC, CySA+ or CISA. Mid-study with a confirmed test date works too, tell us.
You can read logs and tell a real problem from noise. Not detection engineering: looking at a week of sign-in activity and deciding what deserves a ticket.
Writing that holds up: clear, plain, dated and specific. We test this with a short take-home exercise.

Nice To Haves

Time on the inside of a SOC 2 Type 2 or ISO/IEC 27001 certification, on the company's side of the audit rather than the auditor's.
HIPAA as a Business Associate, or NIST 800-53 or FedRAMP evidence work.
Vulnerability management and patch deadline tracking.
Experience with endpoint or awareness tooling such as CrowdStrike Falcon or KnowBe4.
Exposure to AI governance or AI risk work: tool or vendor risk assessment, model inventories, or supporting an AI use policy.

Responsibilities

Run the weekly security review: audit logs across our cloud and identity systems, then vulnerability scan results, written up and published, with tickets opened for anything that needs action.
Keep Vanta healthy: failing tests, evidence collection, document gaps, policy acceptances and vendor security assessments.
Maintain our remediation tracker. Chase owners and flag items before they go late.
Run quarterly access reviews and third-party risk work, including customer security questionnaires.
Support incidents: gather facts, build the timeline, keep the tracker and draft the notification. Escalation calls stay with the Security Officer.
Help get us certified. Gap assessment through observation window through audit, roughly a third of the role.
Run AI governance execution: build and quarterly-refresh the AI systems and agent inventory, and produce the shadow-AI discovery report from our identity, endpoint and monitoring data. Roughly 3 hours a week in year one, less after that. This work sits under Ian, with oversight from the CTO, COO and CEO as appropriate.