Hybrid InfoSec Compliance Analyst — SOC/NIST & RFPs

Vestwell; New York (NY); Hybrid; USD 90,000 - 105,000; Full time

Benefits offered by this job

Company bonus pool

New hire equity

401(k) plan

Hybrid work model

Health benefits

Job summary

Vestwell is a financial technology company powering the new savings economy. Our platform redefines how people save for retirement, education, and healthcare savings needs.

This role sits on Vestwell's Corporate Information Technology team, focusing on monitoring compliance systems and enhancing automation to ensure SOC, ISO, and related controls are met. You will work with Security, Engineering, Legal, and Compliance to advise on policies and best practices, coordinate audits, and respond to

Qualifications

• Experience with SOC, ISO, and other audits.
• Experience responding to RFPs.
• Experience working crossteams to implement new compliance processes

Responsibilities

• Manage cybersecurity risk processes, including risk registers, findings, vulnerabilities, remediation plans, ownership, escalation, and business acceptance within the Vestwell Governance, Risk and Compliance (GRC) solution.
• Manage cybersecurity compliance obligations across regulatory, contractual, and customer requirements, including NIST, ISO and SOC 1&2, and other applicable cybersecurity standards and frameworks.
• Coordinate cybersecurity audits, assessments, evidence requests, customer reviews, and remediation tracking in partnership with Legal, Compliance, IT, and business leaders.
• Support customer, vendor, supplier, and subcontractor cybersecurity risk management, including questionnaires, contract reviews, security expectations, and customer-facing services.

Skills

SOC/ISO auditing

Cross-team collaboration

Regulatory compliance

Tools

CrowdStrike

Vanta

Job description

Vestwell is a financial technology company powering the new savings economy. Our platform redefines how people save for retirement, education, and healthcare savings needs.

This role sits on Vestwell's Corporate Information Technology team, focusing on monitoring compliance systems and enhancing automation to ensure SOC, ISO, and related controls are met. You will work with Security, Engineering, Legal, and Compliance to advise on policies and best practices, coordinate audits, and respond to