Sr. Analyst, IT Security, Risk & Compliance

Sr. Analyst, IT Security, Risk & Compliance
Irvine, CA | Hybrid – 2 days/week onsite | $125K–$145K + 10% bonus

We’re looking for a hands-on IT Security, Risk & Compliance professional to join a fast-growing, consumer-focused company that is actively building and maturing its security program.

This is a great opportunity for someone who wants real ownership and impact. The security/GRC framework is being built today, so you’ll have the opportunity to come in during the implementation phase and help turn the framework into a practical, operational security program.
What You’ll Do

• Own the day-to-day operation and execution of the IT security and GRC program.
• Operate and maintain the company’s ISMS, security controls, risk register, compliance activities and control calendar.
• Coordinate and execute control testing, access reviews, assessments and audit-readiness activities.
• Gather and validate audit evidence, maintain documentation and drive findings through remediation and closure.
• Investigate and coordinate the response to security incidents, vulnerabilities, access issues and security findings.
• Work closely with internal stakeholders, third-party security partners, vendors and the company’s global parent organization.
• Develop and maintain security policies, SOPs, playbooks, control narratives and other security documentation.
• Track security awareness, phishing education, compliance activities, remediation and overall security program health.
• Identify opportunities to improve and mature the security program over time.

What They’re Looking For

• 5+ years of experience in IT Security, GRC, Information Security, Security Compliance or a related area.
• Hands-on experience with security controls, audits, risk assessments, compliance, remediation and control testing.
• Experience with one or more frameworks such as ISO 27001, NIST, SOC 2 or SOX ITGC.
• Strong understanding of Microsoft 365, Entra ID/Azure AD, endpoint management, IAM, cloud security and security operations.
• Experience investigating or coordinating security incidents and vulnerability remediation.
• Strong documentation, organization, communication and follow-through skills.
• Someone who can work independently, navigate ambiguity and figure things out without needing constant direction.

Why This Opportunity?
This isn't a role where you'll simply maintain someone else's mature security program.

The company is actively building its security/GRC framework, giving you the opportunity to help establish how the program operates, take ownership of the controls and processes, and play a meaningful role in its continued maturity.

You'll also work in a highly cloud-based, technology-driven environment with significant exposure to third-party technology and security partners and a global parent organization.

If you're a security/GRC professional who enjoys ownership, problem-solving and building something rather than simply maintaining it, this could be an excellent opportunity.