InfoSec Compliance Analyst II: Risk, Governance & SOC2

HMA Group Holdings, LLC; West Des Moines (IA); On-site; USD 70,000 - 95,000; Full time

Benefits offered by this job

Health, dental and vision

Paid parental leave

401k profit sharing

Continuing education & tuition Reimb.

Generous time-off

Volunteer time off

Diversity & inclusion programs

Job summary

Holmes Murphy & Associates in West Des Moines, IA, seeks an Information Security Compliance Analyst II to support the information security program, risk assessments, and policy development. You will oversee risk mitigation, vendor risk, and audits (SOC2 and others), mapping workflows for compliance and aligning with privacy policies and regulations such as NIST, HIPAA, NYDFS, or GLBA.

This role requires 3–5 years in information security or governance, with experience in GRC tools like Apptega or

Qualifications

• 3–5 years of experience in information security or governance.
• Strong knowledge of privacy policies and regulatory frameworks (NIST, HIPAA, NYDFS/GLBA).
• Experience in risk assessments and audit support.
• Familiarity with SDLC and compliance integration.

Responsibilities

• Support the information security program, including risk, policies, standards, and awareness.
• Lead risk assessments and provide detailed reports with mitigations.
• Oversee policy development to address regulatory requirements.
• Manage vendor risk assessments and third-party reviews.
• Review contractual agreements against compliance standards.
• Develop compliance metrics and reports for senior management and auditors.
• Mentor junior analysts and oversee documentation quality.
• Assist with SOC2 and other audits or assessments.

Skills

Privacy & compliance

Risk assessments

Regulatory knowledge

Security governance

Workflow mapping

Automation tools

Education

Associate/Bachelor's in cybersecurity

Tools

Apptega

Archer

Job description

Holmes Murphy & Associates in West Des Moines, IA, seeks an Information Security Compliance Analyst II to support the information security program, risk assessments, and policy development. You will oversee risk mitigation, vendor risk, and audits (SOC2 and others), mapping workflows for compliance and aligning with privacy policies and regulations such as NIST, HIPAA, NYDFS, or GLBA.

This role requires 3–5 years in information security or governance, with experience in GRC tools like Apptega or