Security & Compliance Analyst

• Monitor and triage security alerts, and escalate real issues
• Coordinate incident response from triage through post-mortem
• Run tabletop exercises
• Triage security advisories and vulnerabilities
• Track patching against remediation SLAs
• Maintain technical security controls, including encryption, key and certificate management, and secrets rotation
• Review cloud and infrastructure configurations against security policies and follow up on fixes
• Run vulnerability scans, backup restores and access reviews
• Collect SOC 2 evidence, including for failing Vanta tests
• Support vendor security reviews, client security questionnaires and GDPR work
• Report on alerts, vulnerabilities and open compliance items
• Work with Engineering, IT and Legal; report to the Director of Legal

• 3 to 5 years in a security operations, cybersecurity or security engineering role
• Working knowledge of SOC 2 and GDPR and audit processes
• Hands-on experience with log analysis, vulnerability management and incident response, including post-mortems
• Working knowledge of encryption and key and certificate management
• Experience securing cloud infrastructure on AWS and GCP
• Excellent written and verbal English communication skills
• Experience with Vanta or a similar compliance platform is nice to have
• Security+, CySA+ or CISSP (or Associate of ISC2) certification is nice to have

• Iterative, empowering processes
• Full ownership and agency to drive projects forward
• Flexible work environment in a distributed team
• Competitive pay
• Flexible PTO
• Quality healthcare coverage
• Education opportunities