Information Security Analyst

Description

The company is an exposure management firm. More than 40,000 organizations worldwide use its products to understand and reduce cyber risk. Its work supports 65 percent of the Fortune 500, 50 percent of the Global 2000, and large government agencies.

The team builds and improves top-tier cybersecurity products for customers. You will work alongside skilled, committed colleagues across the OneTenable team, with the support and resources needed to do meaningful work. The team aims to exceed expectations and succeed together.

Responsibilities

• Join the InfoSec team as a hands-on Mid Risk and Compliance Analyst. Drive compliance and assurance work for products and cloud services, and help with external risk assessments, security assessments, and audits. Your work will shape the company's security and customer trust.
• Act as a company representative with prospects, customers, and partners on security questionnaires, assessments, and audits.
• Work with Sales, Engineering, Information Security, IT, and Product Development to explain compliance obligations and requirements.
• Complete Third-Party Risk Assessments (TPRM Program) for new and potential vendors.
• Teach stakeholders what their responsibilities are.
• Organize and take part in internal and external audit walkthroughs.
• Lead and carry out fixes for issues found in third-party assurance or internal reviews.
• Support special projects as needed, such as building and running the internal compliance program, including audit, certification, and risk assessment preparation.
• Help build, manage, and continuously monitor internal security controls.

Requirements

• Able to work hybrid or onsite at the HQ in Columbia, MD. This position is open only to people based in the US.
• 4+ years of experience performing information security and vendor risk assessments based on accepted industry standards.
• 4+ years of experience responding to security assessments, SAQs, and compliance requirements.
• 4+ years of experience implementing, monitoring, and reporting on control processes, documentation, and remediation items.
• Experience working with the Federal Risk and Authorization Management Program (FedRAMP).
• Self-driven, able to work independently and understand all requirements.
• Strong communication skills and the ability to collaborate effectively with people at all levels.
• An analytical mindset with a rational, pragmatic, and realistic approach to security, risk, and compliance.
• Able to adopt and use technology, with advanced proficiency in Excel, PowerPoint, and Vizio.
• Ideally:
• Knowledge of governance, risk and compliance (GRC) frameworks.
• Experience performing or going through internal and external audits.
• Relevant security certifications such as SSCP, Sec+, or CISA.
• Experience in a Big 4 or similar security consulting or risk assurance role.
• Experience with audits, privacy, and BC and DR program management.
• A BS or BA in Information Technology, Computer Science, Information Security, or a related field.

Conditions

Hybrid or onsite work at the Columbia, MD HQ. US-based candidates only.

Base pay range: $80,500 - $107,166.67 USD. Final pay depends on qualifications, skills, competencies, location, and experience, and may fall outside this range.

Eligible for variable pay on top of base: commission for sales roles, or bonus for non-sales roles, based on company and individual performance.

Equal opportunity: the company values diversity and welcomes applicants from all backgrounds.

The company's data consent notices may apply depending on your location.

Benefits

• Medical, dental, vision, disability, and life insurance.
• 401(k) retirement savings with company match.
• Employee stock purchase plan and employee referral program.
• Flexible spending accounts and an Employee Assistance Program (EAP).
• Education assistance, parental leave, paid time off (PTO), and company-paid holidays.
• Health and wellness events and community programs.