Security Compliance Analyst

Job Description

Job Title: Security Compliance Analyst
Duration: Approximately 6 months with the option to extend depending on new or increasing workload.
Location: Remote (US)
Equipment: MacBook

Duties:

• We seek a detail-oriented Security Compliance Analyst to provide hands-on administrative and program-management support for Security Compliance for approximately 6 months with the option to extend depending on new or increasing workload.
• The person will keep recurring reviews, audits, testing engagements, and customer security requests moving on schedule so Security Compliance specialists can focus on assessment, technical interpretation, and remediation efforts.
• The analyst will work with Security Compliance program owners and relevant cross-functional stakeholders under a defined intake and escalation process.

Responsibilities

Third-Party Security Questionnaire intake and response:

• Monitor assigned customer security questionnaire and document-request queues and relevant channel requests;acknowledge and categorize requests, identify DRIs and due dates, and route requesters to approved self-service materials where appropriate.
• Use the team's questionnaire tool to generate draft responses, then validate them for completeness, accuracy, and consistency with approved security documentation;track DRI input and assemble approved artifacts. Initially, a Security Compliance employee will review the completed responses and approve delivery.
• After training and demonstrated accuracy, the contractor may independently review and deliver routine questionnaires within an agreed, documented scope.
• Escalate bespoke questions, uncertain or outdated answers, new security assertions, nonpublic disclosures, blockers, and deadlines to the appropriate Security Compliance employee or team DRI before delivery.

Quarterly Security Operational Reviews: Maintain the quarter-by-quarter calendar, control/evidence request list, templates, status tracker, evidence links, and follow-up log.

• Collect evidence from control owners, identify missing or late submissions, prepare review packets and draft administrative portions of the report, and track Security Compliance/PCI DRI review and approval.
• The Security Compliance reviewer remains responsible for examining evidence, documenting substantive conclusions, and verifying PCI DSS business-as-usual requirements.

Audit and penetration-test logistics:

• Maintain audit and test calendars, evidence/request trackers, and action logs;schedule walkthroughs from program-owner-approved attendee and scope lists;coordinate vendor meetings, access requests through approved channels, evidence deadlines, and follow-ups.
• Keep a clear record of what was requested, provided, reviewed, and still outstanding.
• Program owners retain audit scope, firm selection, SOW approval, findings, and responses.

Operational reporting and handoff:

• Produce a concise weekly view of open requests, aged items, upcoming milestones, unresolved decisions, and escalations.
• Document repeatable playbooks, templates, owners, and evidence locations to enable a clean handoff at contract end.

Skills:

• Experience coordinating security compliance, audits, compliance operations, or customer security questionnaires.
• Strong written communication, discretion with confidential information;strong program/project management backgrounds and general security familiarity;organized tracking and follow-through, and comfort coordinating across several teams and external parties.
• Familiarity with PCI DSS, SOC1/2, and/or ISO 27001, audit evidence, and security questionnaires is preferred, but not required.
• The role requires reliable execution, sound escalation judgment, and coordination with employee owners for compliance determinations.

Decision and access boundaries:

• Security Compliance employees own control interpretation, evidence acceptance, substantive review findings, new customer-facing security assertions, non-routine disclosure decisions, and attestations.
• Following training and authorization, the contractor may review and deliver routine questionnaire responses within the agreed scope.
• Employee DRIs review exceptions before delivery.
• Employees own purchase orders and vendor-invoice approvals.

Education

• BS/MS Degree with relevant experience.

Meet Your Recruiter

Vanya Smith