Security Analyst

Smartsuite; Newport Beach (CA); On-site; USD 90,000 - 130,000; Full time

Job summary

Capitolis is seeking a Security Analyst in Newport Beach, CA to perform vulnerability tracking, incident analysis, and documentation. The role supports remediation, control testing for audits, and ongoing improvement of security tooling and detection content.

You will collaborate with IT, DevOps, and privacy teams to ensure timely closure of findings and alignment with regulatory requirements. The position emphasizes hands-on investigations, evidence gathering, and maintaining a clear

Qualifications

• Triage and investigate security alerts and incidents.
• Log vulnerabilities, assign remediation and verify closure.
• Document incidents, root causes and corrective actions.
• Support testing of technical controls for audits and privacy.
• Analyze systems and data affected by incidents.
• Maintain security tooling and detection content.

Responsibilities

• Triage and investigate security alerts and incidents.
• Log vulnerabilities and verify remediation.
• Document incidents with root causes and actions.
• Support testing of controls for audits and privacy.
• Maintain security tooling and detection content.

Skills

Vulnerability tracking

Incident analysis

Documentation

Control testing

Tooling maintenance

Detection content

Job description

SmartSuite for the Security Analyst

The Security Analyst executes technical security work: vulnerability tracking and remediation, incident analysis and documentation, control testing support and the technical safeguards that privacy and compliance programs rely on. They turn alerts into investigations and findings into closed actions.

What you own

The Security Analyst executes technical security work: vulnerability tracking and remediation, incident analysis and documentation, control testing support and the technical safeguards that privacy and compliance programs rely on. They turn alerts into investigations and findings into closed actions.

• Triage and investigate security alerts and incidents
• Log vulnerabilities, assign remediation and verify closure
• Document incidents, root causes and corrective actions
• Support testing of technical controls for audits and privacy
• Analyze systems and data affected by incidents
• Maintain security tooling and detection content

Reporting lines

Who this role reports to, who reports to them, and the peers they work with most.

Reports to

Security Operations Manager

Works closely with

Systems Administrator

IT Compliance Manager

Privacy Program Manager

DevOps Engineer

How SmartSuite supports the Security Analyst

The Security Analyst turns alerts into investigations and findings into closed actions, answering to the Security Operations Manager for vulnerabilities and incidents worked to a verified end. SmartSuite keeps one record per incident and vulnerability, linked to the asset, the owner and the evidence, so remediation ages are visible and nothing closes on a promise.

Work alerts, vulnerabilities and incidents to closure

Fixed is not closed until you verify it

Vulnerabilities are logged with their rating and routed to the system owner by exploitability or criticality, with reminders as they age. Closure needs your verification step, so a ticket marked fixed is not the same as a vulnerability that is gone.

Investigation workflows with the same steps every time

Detection, triage, investigation, containment and closure run through a consistent workflow, so a junior analyst and a senior one document the same fields in the same order. NIST SP 800-61 handling is built into the record rather than remembered.

Logs and artifacts kept on the incident

Logs, files, communications and investigation artifacts attach to the incident record as you collect them, and the in-record conversation with the Systems Administrator or DevOps Engineer stays with it. Nothing about the case lives only in chat.

Connect incidents to assets, privacy and compliance

The owner of every affected system on record

The centralized asset inventory gives you owner, location, lifecycle status and vendor for each system, so scoping an incident starts with a lookup rather than a round of emails asking who runs the box.

The Privacy Program Manager reading your findings

When an incident touches personal data, its event details, root cause and corrective actions link to the Privacy Program Manager's impact assessment and breach record, so the notification decision is made on your findings rather than a summary of them.

Control tests evidenced from your remediation data

Security controls link to risks, findings and audit tests, so when the IT Compliance Manager tests patching or incident response for SOC 2 or PCI DSS, the evidence is your remediation records and verification steps, already in order.

Show the SOC what is open and aging

Vulnerability aging by system owner

Open vulnerabilities, their age and remediation rates by system owner are on a live dashboard, so the Security Operations Manager sees which owners are behind and you spend the stand-up on the stuck items rather than the counting.

Post-incident reports drafted with the AI Assistant

The AI Assistant in a SmartDoc field summarizes an incident or drafts the post-incident report from the record, and root cause and pattern analysis across linked incidents shows the recurring issue behind the alerts. Lessons learned are written while the detail is fresh.

A remediation trail that meets regulated deadlines

Every update, test result, approval and remediation action is tracked with full transparency, which is the evidence PCI DSS, NYDFS or BOD 22-01 deadlines require. The timeline of a fix is in the record, not reconstructed from ticket comments.

Security. Logs vulnerabilities, assigns remediation tasks and verifies closure with pre-configured investigation workflows.

Incident. Records event details, root causes and corrective actions and links security incidents to privacy impact assessments.

Asset config. Uses asset and system inventories to scope affected systems during investigations.

Reporting. Reports open vulnerabilities, aging and remediation rates by system owner.

Products this role uses most

Vulnerability Management

Identify, prioritize, and remediate vulnerabilities across systems and applications with automated workflows, SLA tracking, and real-time operational visibility.

Cyber Threat Management

Identify and respond to cyber threats with real-time visibility, structured workflows, and integrated risk and incident management.

Incident Management

Capture and resolve incidents with structured workflows, real-time visibility, and integrated response across risk, compliance, and operations.

Privacy Risk Management

Manage privacy risks with data inventories, PIAs and DPIAs, control tracking, and dashboards that show exposure against GDPR, CCPA, and HIPAA requirements.

Industry reference

NIST SP 800-61 Rev. 3 (April 2025, incident handling) and SP 800-40 Rev. 4 (April 2022, enterprise patch management) and the ISACA CSX and (ISC)2 SSCP job practices describe the work; ISO/IEC 27001:2022 Annex A 8.8 and CIS Controls v8.1 (June 2024) Control 7 require managed, continuous vulnerability remediation. Deadlines are regulated in several sectors: PCI DSS v4.0.1 Requirements 6.3 and 11.3, NYDFS and FFIEC expectations in financial services, HIPAA's risk management standard in healthcare and CISA's Binding Operational Directive 22-01 for federal systems.

Related roles

Security Operations Manager

DEEPEN YOUR KNOWLEDGE

Explore Further

Guides and definitions from the GRC Knowledge Center and the What-is glossary, chosen for this role.

What is Security Incident Management?

What Is Cloud Security Posture Management (CSPM)?

What Is Zero Trust Security?

What Is a Security Operations Center (SOC)?

What Is Incident Response?

Connected GRC for Security Operations

Frequently asked questions

The Security Analyst does the technical security work that programs depend on: triaging and investigating alerts and incidents, logging vulnerabilities, assigning remediation and verifying it closed, documenting incidents with root causes and corrective actions, analyzing the systems and data affected, supporting the testing of technical controls for audits and privacy, and maintaining security tooling and detection content. The role turns alerts into investigations and findings into closed actions, which is where most security programs either work or do not.

Vulnerability Management logs vulnerabilities, assigns remediation tasks and verifies closure with pre-configured investigation workflows, so a finding from a scan becomes a tracked item with a system owner, a due date and a verification step before it is closed. The Security Analyst assigns remediation to the Systems Administrator or the DevOps Engineer and confirms the fix rather than taking the ticket's word for it. Where deadlines are regulated, under PCI DSS or BOD 22-01, the record shows the clock.

Incident Management records event details, root causes and corrective actions, and links security incidents to privacy impact assessments in Privacy Risk Management, so an incident that touches personal data is connected to the assessment covering that processing. The Security Analyst writes up the investigation once, and the Privacy Program Manager sees it against the processing it affects without a separate notification. Cyber Threat Management holds the threat context that explains how the incident arose.

SmartSuite uses asset and system inventories to scope affected systems during investigations, so when an alert names a host or an application, the Security Analyst can see what the system is, who owns it, what it connects to and what data it holds from the inventory rather than asking around. Scoping an incident accurately is what the containment and the notification decisions rest on, and the inventory is also what the IT Compliance Manager tests against.

SmartSuite reports open vulnerabilities, aging and remediation rates by system owner, so the Security Analyst's report to the Security Operations Manager shows how many vulnerabilities are open, how long they have been open and which owners close theirs on time, read from the remediation records. The same view lets the IT Compliance Manager evidence managed remediation under ISO 27001 Annex A 8.8 or CIS Control 7 without the analyst producing a separate extract.

The current list of open vulnerabilities with their systems, the system inventory with owners and the incident log as it stands. New customers can start with SmartSuite Onboarding, a guided four-week program around one or two priority workflows; for a security team the first workflow is vulnerability tracking, because the aging report exposes what has been sitting, with incident documentation brought in at the next post-incident review. Scanners and detection tools stay as they are; SmartSuite is the record of what was found, who owns the fix and whether it was verified.

See SmartSuite for your role

Start a free trial, or book a demo and we will walk through your role's workflows in SmartSuite.