Information Security Analyst

This is a fully remote position, open to applicants in United States.

📋 Description

• Oversee and sustain security and compliance platforms to safeguard ACES information assets and technological infrastructure.

• Shield organizational systems and data from unauthorized access, usage, disclosure, disruption, alteration, and destruction.

• Monitor vulnerability remediation in accordance with SLAs and keep track of new CVEs and known-exploited vulnerabilities affecting the ACES environment.

• Suggest actions for vulnerability remediation.

• Manage the logistics of penetration testing, including the creation of scoping documents, preparation for test days, tracking findings, and overseeing retest attestations.

• Evaluate findings and compile evidence-based proposals for management's consideration.

• Detect non-compliant configurations and assist in remediation efforts with designated teams.

• Execute and document SOC 2 security controls within Secureframe.

• Address auditor requests for evidence, resolve security-control exceptions, and participate in auditor walkthroughs as a subject-matter expert on security controls.

• Review MDR alerts and WAF activities weekly, assess security incidents, escalate when necessary, and support incident response through technical analysis and evidence management.

• Keep records of security procedures, platform configurations, and control evidence.

• Work collaboratively with Technology, Engineering, and Operations teams to integrate security and compliance requirements into systems and processes.

• Act as the primary responder to Vendor Management regarding technical customer security questionnaires and due diligence inquiries.

• Prepare technical security assessments of third-party vendors.

⛳️ Requirements

• A Bachelor’s degree in Information Security, Computer Science, Information Technology, or a related area is required, or equivalent professional experience.

• 3–6 years of practical experience in information security, systems administration, or infrastructure roles that involved genuine security responsibilities.

• Proven experience in managing security or infrastructure tools in a production environment, including configuration, integrations, access control, troubleshooting, and vendor support.

• Experience in implementing security systems, configurations, or guidelines, particularly in Windows and Microsoft 365 endpoint management.

• Knowledge of cloud infrastructure; Azure experience is preferred.

• Experience in identifying vulnerabilities and driving remediation efforts.

• Understanding of data protection regulations and compliance requirements within a technology or financial services environment.

• A current security credential is required: CompTIA Security+ or an equivalent such as ISC2 SSCP, GIAC GSEC, Microsoft AZ-500, or SC-200; or a commitment to obtain Security+ within six months of employment.

• CISSP, CISM, CISA, or similar credentials are advantageous but not mandatory.

• Preferred familiarity with tools like Veracode, StackHawk, AlertLogic, Secureframe, KnowBe4, and experience supporting a SOC 2 Type 2 audit.

• Strong understanding of information security principles, risk assessment methodologies, and compliance frameworks.

• Knowledge of SOC 2 and data protection laws and regulations relevant to financial services.

• Ability to identify and evaluate non-compliant environments and assist or lead remediation initiatives.

• Excellent written and verbal communication skills in a professional context.

• Capacity to collaborate effectively with Engineering, Technology, Operations, and Vendor Management teams.

• Must reside in the United States and possess work authorization documents for employment in the United States.

• A dedication to ongoing learning and staying informed about emerging threats, security technologies, and evolving compliance standards.

🏝️ Benefits

• The opportunity to earn Security+ certification within six months of employment at ACES expense.

• Potential participation in company or team meetings and industry conferences.

• Flexible remote work options.

• Minimal travel requirements of 0%–5%.