IT - Security Compliance Analyst II

• Adhere to, evaluate, and assist in the development of security policies, standards, and procedures; recommend updates to align with legal, regulatory, and business requirements.
• Perform security and compliance assessments to evaluate adherence to internal policies, standards, and applicable regulatory frameworks.
• Assist in identifying control gaps, document findings, and support management and stakeholders in remediation activities.
• Track compliance status, risks, exceptions, and remediation activities, ensuring appropriate documentation and evidence is maintained.
• Assist in internal and external risk assessments, including identifying, analyzing, and documenting security and compliance risks.
• Maintain working knowledge of relevant security and privacy frameworks and regulations (e.g., NIST, CIS, ISO, NAIC, PCI, SOX, HIPAA, or similar, as applicable).
• Assist in delivering guidance and awareness materials to internal teams based on established policies and direction.
• Monitor changes in regulatory requirements, industry standards, and emerging risks, and provide updates to management for review and direction.
• Prepare compliance metrics, status reports, and risk summaries for management review.
• Document activities, assessments, issues, and remediation tracking within designated systems or tools.
• Complete task and project work as assigned.
• Escalates issues, risks, and exceptions to management for review and decision-making.

• →Develop and maintain positive working relationships with internal and third-party vendors as needed.
• →Provide management and team members with clear, accurate, and timely information regarding compliance posture, risks, and issues.
• →Continually improve the security program by identifying gaps in documentation, processes, or controls, and recommending enhancements.
• →Demonstrate strong communication and interpersonal skills with the ability to interact effectively with both technical and non‑technical stakeholders.
• →Support team members by sharing knowledge of security and compliance practices.
• →Ability to follow sound business ethics when executing job responsibilities.
• →Demonstrate a commitment to continuous learning and professional development.
• →Be a self-motivated individual with the ability to complete assigned tasks and priorities within established timelines, escalating issues or competing demands to management as needed.

None

• Bachelor’s degree in Information Technology, Information Security, Risk Management, Business, or a related field, or an equivalent combination of education, training, and experience.
• Background or experience in information security, compliance, governance, risk management, audit, IT operations, or a related discipline is desired.
• Familiarity with developing, maintaining, reviewing, or assessing security policies, standards, and procedures.
• Exposure to security or compliance assessments, risk evaluations, audit support activities, or control testing is beneficial.
• General understanding of IT systems, security controls, and enterprise technology environments.
• Experience working with, interpreting, or mapping controls to recognized frameworks such as NIST CSF, NIST SP 800‑53, CIS Controls, ISO/IEC 27001, or similar.
• Knowledge of regulatory, legal, or contractual security and compliance expectations in regulated or complex environments.
• Security-related professional certifications (e.g., Security+, CISSP, CISA, CISM, CRISC, or similar) are a plus.
• Strong organizational, analytical, and documentation skills with attention to detail.
• Ability to interpret requirements and translate them into clear, practical, and business-aligned guidance.
• Strong written and verbal communication skills, with the ability to engage effectively with both technical and non‑technical stakeholders.
• Demonstrates curiosity and willingness to learn, with interest in understanding the “what,” “why,” and “how” behind security controls and compliance requirements.
• Self-motivated, adaptable, and comfortable working in an evolving security and compliance program.

None

The above statements reflect the general details necessary to describe the principle functions of the occupation described and shall not be construed as a detailed description of all the work requirements that may be inherent in the occupation.