Information Security Analyst Jobs

About The Position

Requirements

• Minimum 5 years of professional experience in Governance, Risk, and Compliance (GRC), cybersecurity compliance, IT audit, risk management, or closely related functions.
• Minimum 5 years of hands-on experience with ISO 27001, SOC 1, SOC 2, and/or other recognized security, risk, or compliance frameworks.
• Minimum 5 years of hands-on experience using GRC platforms such as OneTrust, Hyperproof, RSA Archer, ServiceNow GRC, AuditBoard, LogicGate, or comparable solutions.
• Demonstrated experience conducting internal audits, control assessments, risk assessments, gap assessments, and compliance reviews.
• Experience supporting internal and external audits, certifications, and remediation activities.
• Experience working directly with business and technical control owners to evaluate controls, collect evidence, identify gaps, and resolve findings.
• Experience developing and maintaining policies, standards, procedures, controls, risk documentation, and compliance evidence.
• Experience managing multiple assessments, findings, evidence requests, and remediation activities.
• Strong working knowledge of ISO 27001, SOC 1, SOC 2, and related control environments.
• Strong understanding of GRC principles, information security risk management, control design and effectiveness, audit methodologies, corrective actions, and continual improvement.
• Strong hands-on experience with GRC platforms and management of risks, controls, assessments, evidence, findings, and remediation activities.
• Ability to independently perform internal audits, risk assessments, gap assessments, control reviews, and compliance assessments.
• Ability to interpret framework requirements and translate them into practical controls and documentation.
• Strong analytical and problem-solving skills.
• Strong documentation and evidence-management skills, with attention to accuracy, traceability, and audit readiness.
• Ability to manage multiple priorities and assignments with limited supervision.
• Strong written and verbal communication skills.
• Ability to communicate effectively with technical teams, business process owners, auditors, and management.
• Ability to provide guidance and subject-matter support to other analysts without formal people-management responsibility.
• Knowledge of privacy, data protection, and applicable legal and regulatory requirements.
• Proficiency with Microsoft Office applications, including Excel, Word, PowerPoint, Outlook, and Teams.

Nice To Haves

• Knowledge of ISO 14001 and ISO 50001.
• Bachelor’s degree in a related field.
• Relevant professional certifications such as ISO 27001 Lead Auditor/Lead Implementer, CISA, CRISC, CISM, CISSP, or equivalent GRC or information security credentials.
• ISO 14001 and ISO 50001 auditor credentials.

Responsibilities

• Independently perform GRC, audit, risk, control, and compliance activities.
• Support the maintenance and continual improvement of CloudHQ’s Information Security Management System (ISMS).
• Perform activities supporting ISO 27001:2022, SOC 1, SOC 2, and other applicable security and compliance frameworks.
• Support ISO 14001 and ISO 50001 management system activities, as applicable.
• Conduct internal audits, risk assessments, control assessments, gap assessments, and compliance reviews.
• Support internal and external audits, certifications, and attestations, including evidence collection, documentation review, auditor requests, findings, and remediation.
• Work directly with business and technical process owners to evaluate controls, identify gaps, and develop remediation actions.
• Track audit findings, non-conformities, risks, corrective actions, and remediation activities through closure.
• Maintain GRC platforms, including risk registers, control libraries, assessments, evidence, findings, remediation activities, and compliance reporting.
• Develop, review, and maintain policies, standards, procedures, controls, and supporting compliance documentation.
• Review evidence and documentation for completeness, accuracy, traceability, and audit readiness.
• Provide GRC and compliance guidance to business and technical teams.
• Monitor applicable compliance requirements and support updates to controls and documentation.
• Prepare compliance, audit, risk, and remediation status information for management reporting.
• Support security and compliance awareness and training initiatives.
• Identify opportunities to improve and standardize GRC processes, documentation, workflows, and reporting.
• Provide guidance and subject-matter support to other analysts as needed.

Benefits

• Competitive compensation and rewarding incentives.
• Comprehensive medical, dental, vision, life insurance, and disability benefits.
• 401(k) with match.
• 12 paid holidays.
• Generous PTO.
• Development opportunities.
• Opportunity to closely impact and contribute to the growth of the organization.