Hands-On Security Compliance Analyst – Audits & Evidence

Sur; United States; On-site; USD 22,000 - 33,000; Full time

Job summary

Sur is seeking a Security Compliance Analyst to manage security, compliance, and customer assurance programs. You will work with the VP of Information Security & Compliance on audits, questionnaires, control testing, and evidence collection in a hands-on role.

Responsibilities include handling DDQs, RFP security sections, maintaining a library of responses, coordinating with SMEs, and ensuring timely remediation across IT and cloud environments.

Qualifications

• 3+ years of experience in IT, security, GRC, or related field.
• Hands-on security compliance, audit evidence, and control testing experience.
• Excellent spoken English for meetings with US-based customers and auditors.
• Ability to manage multiple questionnaire requests and deadlines with attention to detail.

Responsibilities

• Complete customer security questionnaires and related reviews.
• Research technical questions and provide accurate answers based on environment.
• Maintain library of approved responses and evidence.
• Know when SME involvement is needed.
• Participate in customer security calls for deep discussions.
• Help speed the customer assurance process while staying accurate.
• Track findings, remediation, and control-owner commitments.
• Manage deadlines and report status.
• Coordinate with teams to close tasks.

Skills

Security concepts

GRC/compliance

Audit evidence

English communication

Organization & deadlines

Windows administration

Cloud architectures

PowerShell scripting

Technical documentation

Questionnaires & DDQs

Tools

AWS

GitHub

Ticketing systems

Endpoint-management tools

Job description

Sur is seeking a Security Compliance Analyst to manage security, compliance, and customer assurance programs. You will work with the VP of Information Security & Compliance on audits, questionnaires, control testing, and evidence collection in a hands-on role.

Responsibilities include handling DDQs, RFP security sections, maintaining a library of responses, coordinating with SMEs, and ensuring timely remediation across IT and cloud environments.