Security Analyst Jobs

About The Position

Requirements

• Two-year or four-year degree in information security, information technology, business, or related field; or 3+ years of equivalent experience
• 2–5 years of experience in a security analyst, GRC, IT audit, compliance, or similar role
• Working knowledge of security and compliance frameworks such as SOC 2, NIST CSF, or ISO 27001
• Experience responding to security questionnaires, conducting vendor assessments, or supporting audits
• Familiarity with data privacy regulations (CCPA, GDPR, etc.)
• Hands-on experience using generative AI tools, and a strong interest in AI governance and safe adoption
• Excellent written communication — much of this work is turning technical reality into clear, accurate answers
• Strong organization and attention to detail, with the ability to manage many parallel workstreams
• Ability to work effectively with technical and non-technical stakeholders across the business

Nice To Haves

• Certifications such as Security+, CISA, CRISC, or CIPP
• Experience with compliance automation platforms (Vanta, Drata, or similar)
• Familiarity with AI governance frameworks (NIST AI RMF, ISO/IEC 42001, OWASP GenAI Security)
• Exposure to security operations tooling (SIEM, EDR) and alert triage
• Experience with M365 and Google Workspace administration or security configuration
• Basic scripting skills (Python or similar) for reporting and automation
• Experience working with personal information or other regulated data

Responsibilities

• Own client security questionnaires end to end; build and maintain a reusable answer library to make each response faster and more consistent
• Conduct vendor security assessments for new vendors and renewals; maintain ongoing vendor risk tracking
• Run SOC 2 compliance operations, including evidence collection, control monitoring, and audit support
• Maintain the risk register: track remediation owners and progress, and prepare quarterly risk reviews
• Drive the policy lifecycle: annual reviews, redline recommendations, and exception tracking
• Support review of client contractual security obligations in partnership with our contracts administration team
• Support data privacy compliance operations (CCPA, GDPR, etc.), including data inventory and mapping, subprocessor tracking, and data subject request support
• Operate the AI tool and vendor intake process: triage requests, run security and risk reviews, and document decisions
• Conduct AI risk assessments using our risk methodology — threat modeling, control analysis, and risk scenarios — and help mature it into a repeatable framework
• Build and maintain our AI inventory of approved tools, agents, and connectors; monitor for unapproved AI use
• Maintain AI usage policies and standards, and manage the exception process
• Support access reviews for AI agents and connectors, including what data non-human identities can reach
• Deliver secure-AI enablement: training, office hours, and onboarding users to approved tools
• Track the evolving AI regulatory and framework landscape (EU AI Act, NIST AI RMF, OWASP GenAI Security) and the AI governance sections appearing in client questionnaires
• Manage the security awareness training program, including content updates, completion tracking, and new-hire onboarding
• Run phishing simulation campaigns, reporting, and follow-up coaching
• Own security communications and the intake channel for employee security questions
• Coordinate and execute periodic user access reviews and validate offboarding completion
• Review third-party application and OAuth grants across M365 and Google environments
• Build and maintain security metrics and dashboards covering operational trends, compliance posture, and training completion; support leadership reporting
• Produce periodic threat intelligence digests for the team
• Depending on experience and interest, support security alert triage, incident documentation, and tabletop exercise coordination
• Support business continuity and disaster recovery plan maintenance and test coordination

Benefits

• Base Salary
• Annual Bonus
• Access to all office spaces in MSP, NYC, and CHI
• Frequent, paid travel to our Minneapolis headquarters for company events, team events, and in-person collaboration with teams
• Generous paid vacation policy
• 401k match program
• Top-notch health insurance options, inclusive of same sex partners
• Family formation benefits including reimbursement options for fertility, pregnancy, and parenting needs
• Monthly stipend for your mobile phone and data plan
• Sabbatical program
• Charitable giving via our time and a financial match program
• Shenanigan’s Day