Security Risk Governance Analyst

What you'll do

• Execute end-to-end third-party security reviews including due diligence, evidence collection, and vendor interviews.
• Support compliance programs such as SOX, PCI DSS, SOC 2, and ISO 27001 through audit preparation and coordination.
• Conduct risk assessments, gap analyses, and controls testing for new tools, AI systems, and business lines.
• Manage the lifecycle of security risks by tracking findings and remediation actions in the risk register.
• Perform quarterly user access reviews for applications within the scope of major compliance frameworks.
• Develop and maintain security KPIs, KRIs, and dashboards to provide leadership with visibility into program performance.
• Create operational runbooks, security baselines, and standards while transitioning manual processes into automated workflows.
• Manage Security Architecture Reviews by coordinating with engineering teams to document and stabilize the process.

What we're looking for

• 2–4 years of experience in security, IT audit, risk, or compliance in a regulated environment.
• Hands-on experience with third-party security reviews, risk assessments, or controls testing.
• Professional experience focused on information security, security risk, and/or security program management.
• Experience using vulnerability management tooling and managing security risk exceptions through their lifecycle.
• Working knowledge of frameworks such as SOX, SOC 2, NIST 800-series, ISO 27001, and PCI DSS.
• Experience documenting security procedures, operational processes, standards, and runbooks.
• Evidence of driving work to closure through people you do not manage by chasing owners and escalating when stalled.
• Progress toward a security or audit certification such as CISA, CRISC, or Security+ (preferred); experience with AWS, GitHub, or GCP (preferred).