Information Security Analyst

Veriipro; Phoenix (AZ); On-site; USD 90,000 - 120,000; Full time

Job summary

Veriipro is seeking an experienced Information Security Analyst to drive risk management, audits, and compliance across enterprise IT. You will design and document security controls, perform assessments, and support remediation efforts to meet regulatory requirements.

The role requires familiarity with NIST, RMF, HIPAA/HITECH, and related standards, plus the ability to communicate findings and guidance to technical and non-technical stakeholders.

Qualifications

• Experience performing security risk assessments, audits, control reviews, and compliance assessments.
• Strong knowledge of NIST SP 800-53 Rev. 5, RMF, IRS Publication 1075, HIPAA/HITECH, HITRUST, CJIS, and MARS-E.
• Experience with security and privacy control selection, implementation, assessment, and authorization.
• Strong knowledge of information security policies, risk management, internal controls, and audit practices.
• Experience identifying security gaps, developing findings, recommendations, POA&Ms, and remediation plans.
• Ability to investigate suspicious activity and support security incident reporting.
• Understanding of IT environments including Windows, Unix/Linux, databases, networking, and software development.
• Strong technical documentation, analytical, written, and verbal communication skills.

Responsibilities

• Conduct security assessments, audits, and risk reviews and document findings and recommendations.
• Prepare audit reports, risk assessments, security plans, incident reports, and POA&Ms.
• Review and maintain security policies, audit plans, risk documentation, and compliance artifacts.
• Evaluate security controls and identify areas of non-compliance and improvement.
• Track remediation activities and report outcomes to management.
• Research cybersecurity regulations, standards, and industry best practices to support compliance.
• Identify cybersecurity and privacy risks across internal and external systems and recommend mitigation strategies.
• Support project teams with security and compliance requirements.
• Collaborate with IT, security, audit, compliance, and business teams.
• Provide security guidance and develop training/user-support materials as required.

Skills

Security risk assessments

NIST SP 800-53

RMF

security/privacy controls

policies and audits

gap analysis & POA&Ms

security incident reporting

IT environments knowledge

technical documentation & comms

Job description

We are seeking an experienced Information Security Analyst with strong expertise in cybersecurity risk management, security audits, compliance, internal controls, and security governance.

Required Skills

• Experience performing security risk assessments, audits, control reviews, and compliance assessments.
• Strong knowledge of NIST SP 800-53 Rev. 5, RMF, IRS Publication 1075, HIPAA/HITECH, HITRUST, CJIS, and MARS-E.
• Experience with security and privacy control selection, implementation, assessment, and authorization.
• Strong knowledge of information security policies, risk management, internal controls, and audit practices.
• Experience identifying security gaps, developing findings, recommendations, POA&Ms, and remediation plans.
• Ability to investigate suspicious activity and support security incident reporting.
• Understanding of IT environments including Windows, Unix/Linux, databases, networking, and software development.
• Strong technical documentation, analytical, written, and verbal communication skills.

Roles & Responsibilities

• Conduct security assessments, audits, and risk reviews and document findings and recommendations.
• Prepare audit reports, risk assessments, security plans, incident reports, and POA&Ms.
• Review and maintain security policies, audit plans, risk documentation, and compliance artifacts.
• Evaluate security controls and identify areas of non-compliance and improvement.
• Track remediation activities and report outcomes to management.
• Research cybersecurity regulations, standards, and industry best practices to support compliance.
• Identify cybersecurity and privacy risks across internal and external systems and recommend mitigation strategies.
• Support project teams with security and compliance requirements.
• Collaborate with IT, security, audit, compliance, and business teams.
• Provide security guidance and develop training/user-support materials as required.