Analyst, Security & Compliance

Decisions; Virginia Beach (VA); Hybrid; USD 70,000 - 110,000; Full time

Benefits offered by this job

Remote option

Health benefits

Professional development

Paid time off

Recognition programs

Flexible hours

Job summary

Decisions is seeking an Analyst, Security & Compliance to strengthen our security operations, vulnerability management, and audit programs. You will coordinate with Security, Engineering, IT, HR, and business teams to ensure controls are effective and regulatory requirements are met.

You will manage audit evidence, support SDLC security, and drive improvements across security programs while maintaining strong written and verbal communication with auditors and stakeholders.

Qualifications

• 2+ years of experience in information security, compliance, IT, risk management, or related field.
• Experience supporting external audits such as SOC 2, ISO 27001, PCI DSS, or similar.
• Experience reviewing vulnerability scans and coordinating remediation with technical teams.
• Strong technical aptitude with cloud platforms and security tools.
• Ability to manage multiple priorities and meet deadlines in a fast-paced environment.

Responsibilities

• Own customer security questionnaires from intake through completion, including evidence gathering and secure delivery.
• Manage vulnerability scanning activities and coordinate remediation across products and systems.
• Review security scan results before releases and route high-risk findings appropriately.
• Help maintain strong external security ratings and continuously improve security posture.
• Participate in the incident response program and act as Incident Response Coordinator when needed.
• Investigate phishing attempts and coordinate remediation activities across the organization.
• Conduct phishing simulations and security awareness initiatives.
• Review software, vendor, and AI tool requests for compliance with company policies.
• Maintain and update risk registers, security documentation, and compliance records.
• Partner with Engineering to support secure SDLC requirements.
• Administer security awareness training programs and track completion metrics.
• Support least-privilege access reviews and security governance processes.
• Own and support compliance activities for PCI DSS, SOC 2 Type II, ISO 27001 and future initiatives.
• Gather, review, organize, and manage audit evidence for external and internal audits.
• Communicate with auditors and stakeholders to resolve findings and action items.
• Execute assigned security controls and support internal control testing.
• Serve as backup owner for security and compliance controls.

Skills

Security practices

Vulnerability management

Audit coordination

Documentation

English fluency

Incident response

Phishing awareness

Compliance knowledge

Cloud platforms

Tools

CrowdStrike

Azure

AWS

Splunk

Job description

At Decisions, we help organizations make work easier through intelligent process orchestration. Our platform brings workflows, rules, approvals, and AI together so teams can simplify complex processes, move faster, and focus on the work that matters most. Behind that platform is a team of curious, collaborative people who take ownership, support one another, and care about creating real impact for our customers. If you're excited by meaningful work, smart teammates, and opportunities to grow, Decisions could be a great place for you.

About the Role

Decisions is looking for an Analyst, Security & Compliance to join our Compliance team. In this role, you'll help protect our products, data, employees, and customers by supporting security operations, vulnerability management, compliance programs, and audit activities. You'll work across Security, Engineering, IT, HR, and business teams to ensure security controls are operating effectively, risks are identified and remediated, and regulatory requirements are met.

You'll help support the organization's security posture and compliance objectives by managing security processes, coordinating audit activities, responding to security events, and driving continuous improvement across our security and compliance programs.

What You'll Own

• Own customer security questionnaires from intake through completion, including evidence gathering, review, and secure delivery.
• Manage vulnerability scanning activities and coordinate remediation efforts across products and systems.
• Review security scan results before releases and ensure critical and high-risk findings are routed appropriately.
• Help maintain strong external security ratings and continuously improve security posture.
• Participate in the incident response program and serve as Incident Response Coordinator when needed.
• Investigate employee-reported phishing attempts and coordinate remediation activities.
• Conduct phishing simulations and security awareness initiatives across the organization.
• Review software, vendor, and AI tool requests for compliance with company security policies.
• Maintain and update risk registers, security documentation, and compliance records.
• Partner with Engineering to support secure software development lifecycle (SDLC) requirements.
• Administer security awareness training programs and track completion metrics.
• Support least-privilege access reviews and security governance processes.
• Own and support compliance activities for PCI DSS, SOC 2 Type II, ISO 27001, and future compliance initiatives.
• Gather, review, organize, and manage audit evidence for external and internal audits.
• Communicate directly with auditors and stakeholders to resolve findings and action items.
• Execute assigned security controls and support internal control testing activities.
• Serve as backup owner for security and compliance controls managed by other team members.
• Track remediation efforts and ensure security and compliance commitments are completed on time.

What You Bring

• 2+ years of experience in information security, compliance, IT, risk management, or a related field.
• Experience supporting external audits such as SOC 2, ISO 27001, PCI DSS, or similar frameworks.
• Experience reviewing vulnerability scans and coordinating remediation with technical teams.
• Strong technical aptitude and comfort working in cloud platforms, identity management systems, and security tools.
• Ability to manage multiple priorities and meet deadlines in a fast-paced environment.
• Strong attention to detail and process-oriented mindset.
• Excellent written and verbal communication skills in English.
• Ability to work independently while collaborating across technical and non-technical teams.
• Sound judgment and problem-solving skills.
• Availability to work U.S. Eastern business hours and participate in an on-call rotation.

Bonus Points

• Experience with PCI DSS compliance programs, SAQs, or ROC assessments.
• Hands-on experience with EDR/XDR platforms such as CrowdStrike.
• Familiarity with SAST, DAST, or secure SDLC security practices.
• Experience administering GRC platforms, evidence repositories, or compliance management tools.
• Experience with Python, PowerShell, APIs, or security automation initiatives.
• Exposure to AI governance, ISO 42001, or AI risk management programs.
• Experience working with AWS, Azure, Linux, or cloud security controls.
• Security certifications such as CompTIA Security+, ISO 27001 Lead Auditor, or similar.

At Decisions, we want our employees to feel supported, connected, and able to do their best work.

• Competitive compensation and performance-based incentives.
• Comprehensive health and wellness benefits.
• Flexible work environment with opportunities for remote or hybrid work.
• Professional development, learning, and certification support.
• Collaborative, high-growth culture with opportunities to make a meaningful impact.
• Paid time off, company holidays, and employee recognition programs.