Information Security Governance Analyst

Lancesoft; Foster City (CA); On-site; USD 110,000 - 124,000; Full time

Job summary

Lancesoft seeks an Information Security Governance Analyst to ensure adherence to governance, risk, and compliance standards. The role involves conducting internal assessments, risk analyses, and coordinating audits across IT, Product Security, and other departments onsite in Foster City, CA.

Requires 5+ years in security control assessments and strong knowledge of ISO 27001, NIST CSF, GDPR/CCPA. L5 candidates should have 8+ years of relevant experience; salary is hourly and onsite.

Qualifications

• 5+ years of conducting security control assessments or audits.
• Experience with information security standards and privacy laws (e.g., ISO 27001, NIST, GDPR, CCPA, CPRA).
• L5 candidates would be expected to have 8+ years of relevant experience.

Responsibilities

• Lead organization-wide compliance assessments and audits.
• Coordinate internal and external audits with IT, Product Security, and other departments.
• Develop and maintain the control framework and compliance documentation.
• Serve as liaison between IT and internal auditing teams to ensure regulatory alignment.

Skills

GRC frameworks

Risk assessment

ISO 27001

NIST CSF

GDPR/CCPA

Auditing

AI security

Analytical skills

ICS/SCADA experience

Education

Bachelor's degree

Tools

Vulnerability scanners

File integrity monitoring

Configuration monitoring

Perimeter security

Job description

Job Title: Information Security Governance Analyst

Job Duration: 06+ months

Pay Range: $80-$90 hourly USD

Work Type: Onsite (Foster City, CA, 94404)

Job Description:

We are seeking an highly skilled Information Security Governance Compliance Analyst who will be responsible for ensuring that the organization adheres to established information security governance, risk management, and compliance (GRC) frameworks. This role involves conducting internal compliance assessments, risk assessments, and ensuring adherence to policies and standards. The analyst will work closely with various departments to ensure compliance with frameworks such as NIST 800-53, NIST CSF 2.0, ISO 27001, ISO 21434, and other relevant standards.

Compliance Activities:

Develop and implement security management systems to track objectives and controls. Plan and lead organization-wide security audits to ensure compliance with relevant policies, standards, and frameworks (e.G. NIST 800-53, ISO 27001, NIST CSF 2.0 etc.). Coordinate internal and external audits with IT, Product Security, and other departments/teams. Prepare, review, and maintain compliance documentation.

Risk Assessments:

Conduct risk exposure assessments to identify potential threats and vulnerabilities. Perform comparative risk assessments to evaluate different solutions and their impact on security. Prioritize risks based on their potential impact and likelihood, determining security ROI for prioritization considerations. Develop and implement remediation plans for identified risks.

Policy and Standards Management:

Ensure compliance activities align with existing policies, standards, frameworks, and industry regulations. Identify and address shortcomings in platform security and compliance processes. Develop and maintain the control framework, ensuring it is up-to-date and effective.

Collaboration and Communication:

Serve as a liaison between IT and internal auditing teams. Work with various departments to ensure compliance with internal and external requirements.

Qualifications Experience:

5+ years of experience in conducting security control assessments or audits. L5 candidates would be expected to have 8+ years of relevant experience 5+ years’experience with information security standards and privacy laws (e.G., ISO 27001, NIST, GDPR, CCPA, CPRA, etc.). L5 candidates would be expected to have 8+ years of relevant experience

Skills / Knowledge / Abilities:

Strong knowledge of GRC frameworks and tools. Proficiency in risk assessment methodologies and tools. Hands-on familiarity with the following —you don't need to be an expert, but you should be comfortable working with them: LLMs (Large Language Models), AI (artificial intelligence), ML (machine learning) security management tools (e.G., vulnerability scanners, file integrity monitoring, configuration monitoring, etc.) and perimeter technologies (e.G., router, firewalls, web proxies and intrusion prevention, etc.). Excellent analytical and critical thinking skills. Experience in automotive, aerospace, industrial control systems (ICS/SCADA), or high-assurance environments is beneficial, but not required.

Education:

Bachelor’s degree in computer science, Information Systems, Business, or a related field, or equivalent relevant experience.