Cybersecurity Analyst

Role overview

Support governance, risk, and compliance work for a security program built around NIST CSF 2.0 and SOC 2. This associate-level role turns framework requirements into policies, controls, evidence, and repeatable processes, while helping multiple organizations assess and improve their security practices in partnership with security and IT leaders.

Responsibilities - Maintain NIST CSF profiles, track control gaps, update security policies, and keep the risk register current through resolution. - Map requirements across NIST CSF, SOC 2, CIS Controls, and ISO/IEC 27001 to reduce duplicated control work. - Review supplier security materials, assess them against due diligence criteria, and provide findings for leadership decisions. - Establish and review security baselines for portfolio companies; assess compliance, document gaps, and track remediation plans. - Collect and organize compliance evidence manually, maintain status trackers, and report risks and progress to leadership. - Coordinate recurring control activities such as access reviews, security training, policy attestations, and tabletop exercises; support audit and incident documentation as needed.

Requirements - 0–3 years in information security, GRC, IT audit, risk, or IT operations; internships and relevant academic work count. - Degree in cybersecurity, information systems, computer science, or a related field, or equivalent practical experience. - Working knowledge of a major security framework and basic familiarity with SOC 2 Trust Services Criteria and Type I versus Type II reports. - Strong organization and follow-through across many owners and open items, with clear written and verbal communication. - Process-oriented approach, including documenting work so it can be repeated. - Familiarity with core IT concepts such as identity and access management, endpoints, networks, and cloud services.

Nice to have - Security or audit certifications; experience supporting a SOC 2, ISO 27001, or similar audit. - Strong spreadsheet skills and familiarity with cloud platforms, workplace security settings, compliance tools, or project trackers.

Benefits and work setup - Hybrid work preferred near Broomfield, Colorado, or Foster City, California; remote candidates may be considered in several listed U.S. states. - Listed total annual compensation is $120,000–$150,000, with profit sharing, medical, dental, and vision coverage, a 401(k) match, and flexible paid time off.