Cybersecurity Risk & Compliance Analyst

Department: Technology — Security Reports to: CISO Location: Remote Employment type: Full-time

Own the inventory of SaaS applications company-wide, including access management (SSO/SAML/OIDC, MFA, SCIM provisioning/deprovisioning) and configuration hardening against vendor and industry baselines
Manage the joiner/mover/leaver access lifecycle on least-privilege principles
Monitor security posture and remediate misconfigurations
Run vulnerability management across our SaaS and cloud environment — identifying, prioritizing, and tracking vulnerabilities to remediation, using our existing monitoring tools (e.g., Cloudflare WAF/Log Explorer) and any additional scanning tools
Support investigation of security incidents and suspicious activity — scoping, containing, and documenting findings, using scripting where useful to analyze logs or automate parts of the investigation
Contribute to post-incident documentation and follow-up remediation tracking
Support secure implementation of integrations between internal and third-party systems: API key management, OAuth scopes, service account governance, and webhook security
Review integration requests from Engineering and business teams for security and compliance impact before approval

Help run a structured, ongoing risk management program for the company — identifying risks, assessing their severity/likelihood, tracking remediation to closure, and reporting status on a regular cadence
Conduct control assessments against our adopted frameworks (HIPAA Security Rule and NIST CSF — our risk framework already on the roadmap) and identify gaps
Bring Zero Trust and modern risk-management principles into how we evaluate new systems, vendors, and technical decisions
Actively participate in the company's AI use case assessment process — evaluating proposed AI tools and use cases from a technical, security, and compliance perspective. Like vendor assessment, this is a cross-functional process with several stakeholders, not an area this role owns exclusively
Contribute risk analysis to support risk-based decisions — translating technical risk into business terms

Operate and maintain compliance automation in Vanta: evidence collection, control monitoring, remediation tracking, audit readiness
Execute recurring access reviews and produce audit-ready documentation
Support HIPAA compliance activities: risk assessments, vendor security reviews, BAA tracking, policy enforcement across SaaS systems
Conduct vendor/third-party risk assessments for new SaaS purchases; maintain the vendor risk register
Support ongoing security monitoring and log review to help confirm controls (including NIST CSF controls) are actually operating as intended, not just documented as if they were

4–6+ years in cybersecurity risk management, GRC, or security operations roles, with real ownership of both hands-on security administration and a structured risk/compliance program
Experience running a formal risk management process — identifying, assessing, tracking, and reporting on risk to closure — under any recognized framework (NIST RMF, ISO 27001, NIST CSF, or equivalent); the specific framework matters less than the discipline of running the process end-to-end
Experience with identity providers and SSO (Google Workspace, Okta, Entra ID, or similar): SAML, OIDC, SCIM, MFA policy design
Experience with compliance automation platforms (Vanta, Drata, Secureframe, or similar)
Comfort with APIs and integration concepts: OAuth flows, API tokens, scopes, webhooks
Solid scripting/automation skills (Python, Bash, or similar) — used for secure integration work and to support incident investigations (e.g., log analysis, automating recurring checks), not just for provisioning tasks
Strong documentation habits: risk registers, access review records, runbooks, vendor assessments, that stand up to audit
Professional English (written and spoken); Spanish is a plus

Fluent in written and oral Spanish in addition to English
Demonstrated ability to communicate risk to non-technical stakeholders and support executive-level, risk-based decision making — valuable, but something that can also develop on the job
Experience in a HIPAA-regulated or otherwise regulated/high-compliance environment
Familiarity with Zero Trust Architecture principles
Familiarity with our stack: Google Workspace, GCP, Cloudflare, Vanta, HubSpot, Stripe, BigQuery
Certifications such as Security+, CySA+, or similar