Security Compliance Analyst - Information Technology - Dallas

Winstead•Dallas, TX

About The Position

The Security Compliance Analyst supports the organization’s information-security compliance program, working with senior team members on security audits, client compliance requests, ISO processes, and vendor security reviews. This early-career role collaborates with Engineering, Legal, Procurement, and other teams and provides exposure to governance, risk, and compliance activities, including risk tracking, third-party risk management, policy administration, and compliance reporting, with guidance from senior staff. The role supports audits and client security reviews by gathering evidence, tracking responses and open items, responding to questionnaires with senior review, maintaining records, and coordinating input from subject-matter experts. It also helps maintain ISO compliance processes and ISMS documentation, supports reviews and continual improvement, monitors standards and customer requirements, tracks corrective actions and findings, and assists with policy lifecycle administration. The analyst works with Engineering, IT, and Product to understand systems and data flows; documents security controls, gaps, remediation, and audit evidence; and supports vendor intake, reviews, reassessments, and inventory maintenance. Additional GRC duties include maintaining risk registers and program documentation, supporting risk assessments and reporting, documenting processes, and identifying process-improvement and automation opportunities.

Requirements

0–2 years of experience or exposure to information security, IT, compliance, audit, risk management, or related functions; internships, academic projects, and entry-level roles count.
Strong organizational skills and attention to detail.
Strong written and verbal communication skills.
Ability to manage multiple tasks, track follow-ups, and meet deadlines with guidance.
Proficiency with Microsoft Office, particularly Excel, Word, Outlook, and Teams.
Willingness to learn security, compliance, vendor risk, and audit concepts.
Ability to handle sensitive and confidential information professionally.
Relevant experience may be considered in lieu of a degree.

Nice To Haves

A bachelor's degree in Information Security, Cybersecurity, IT, Business, Risk Management, or a related field; equivalent hands-on experience is weighed equally or higher.
Entry-level certifications such as CompTIA Security+, ISC2 Certified in Cybersecurity (CC), ISO 27001 Foundation, or Microsoft Security Fundamentals, or willingness to pursue them.
Familiarity with frameworks such as ISO 27001, ISO 27701, SOC 2, or the NIST Cybersecurity Framework.
Experience maintaining documentation, inventories, records, or audit-related materials.
Interest in GRC, Third-Party Risk Management (TPRM), privacy, or information security.

Responsibilities

Coordinate security audits by gathering evidence, tracking responses, and following up on open items.
Respond to client security questionnaires and requests for information with senior review; answer routine security-compliance questions.
Maintain an organized repository of approved responses, policies, and audit records.
Support the legal team during client security reviews and coordinate subject-matter-expert input.
Identify recurring client requests and help update standard response materials.
Help maintain ISO compliance processes, including ISO/IEC 27001, and keep ISMS documentation current.
Support internal reviews, audits, and continual-improvement activities; monitor updates to security standards and customer requirements.
Maintain compliance calendars and track corrective actions, remediation, and audit findings.
Support policy lifecycle activities, including periodic review, version control, approval tracking, and publication.
Work with Engineering, IT, and Product teams to understand systems and data flows.
Document and track security controls, identify control gaps, coordinate remediation with technical owners, and prepare audit-ready evidence.
Review vendor security documentation, including questionnaires, SOC reports, and ISO certificates, and document gaps.
Maintain a centralized inventory of vendors, applications, and SaaS services, including risk level and review status.
Support periodic vendor reassessments, track review schedules, and help ensure new-vendor security reviews are completed and documented before access is granted.
Escalate higher-risk or unclear vendor situations to senior team members.
Maintain risk registers, compliance records, and security program documentation.
Document security processes, workflows, and procedures; support periodic risk assessments and maintain security metrics, dashboards, and recurring reporting.
Identify process-improvement and automation opportunities across compliance and security operations.