Information Security Risk & Compliance Analyst

audaxgroup; Boston (MA); In loco; USD 120.000 - 180.000; Tempo pieno

Descrizione del lavoro

Audax Group is seeking an Information Security Risk Analyst to own risk assessment activities across vendors, applications, and internal systems. You will lead SOC 1 IT control evidence gathering, coordinate audits, and manage due diligence questionnaires ensuring consistent remediation tracking.

You will partner with IT, Legal, Compliance, IR, and business stakeholders to translate security risks into practical mitigation plans, improving audit readiness and investor confidence while supporting

Competenze

• Strong understanding of risk management frameworks (NIST CSF, ISO 27001, SOC 1/2 controls).
• Experience performing third-party, application, and internal technology risk assessments using a consistent methodology (likelihood, impact, inherent, residual).
• Familiarity with control frameworks and mapping (e.g.: NIST CSF, ISO 27001, SOC 1 ITGC, SOC 2).
• Experience maintaining risk registers, remediation tracking, control mappings, and supporting evidence repositories.

Mansioni

• Perform independent information security risk assessments for vendors, applications, systems, and business processes.
• Conduct application security vetting, including architecture reviews, control validation, and risk documentation.
• Apply consistent risk rating methodology (likelihood, impact, inherent, residual) and document scoring rationale.
• Partner with control owners to define practical remediation plans, including interim compensating controls.
• Facilitate recurring risk review check-ins with control owners to validate progress on remediation plans.
• Support risk exception and risk acceptance workflows (evidence collection, summaries, and tracking).
• Maintain and update risk registers, remediation tracking, and control mappings.
• Map assessment results to common security and control frameworks (e.g., NIST CSF, ISO 27001, SOC 1 & SOC 2).
• Contribute to policy, standard, and control development initiatives.
• Identify process improvements and support continuous improvement of GRC tooling.
• Develop risk narratives that translate technical controls into business-relevant language.
• Support business continuity and resilience efforts (BIA input and tracking).
• Partner with business stakeholders to reduce onboarding cycle time through repeatable processes.

Conoscenze

NIST CSF

ISO 27001

SOC 1/2 controls

IT risk assessment

DDQ coordination

Control mapping

Vendor risk

Application security

Descrizione del lavoro

Audax Group is seeking an Information Security Risk Analyst to own risk assessment activities across vendors, applications, and internal systems. You will lead SOC 1 IT control evidence gathering, coordinate audits, and manage due diligence questionnaires ensuring consistent remediation tracking.

You will partner with IT, Legal, Compliance, IR, and business stakeholders to translate security risks into practical mitigation plans, improving audit readiness and investor confidence while supporting