Security Analyst

Lucid Software; Raleigh (NC); On-site; USD 70,000 - 110,000; Full time

Job summary

Lucid Software in Raleigh, NC is seeking a Security Risk Analyst to perform third-party vendor risk assessments, respond to security questionnaires, and support SOC 2 and ISO 27001 compliance efforts. You will identify threats, design security improvements, deliver awareness training, and coordinate with Legal, IT, Engineering, Finance, and HR to strengthen policies.

The role requires 2–3 years of risk management experience and a solid understanding of NIST 800-53, ISO 27001, and SOC 2; a

Qualifications

• Bachelor’s degree in information security assurance, business management, or related field.
• 2–3 years of third-party risk management experience.
• Understanding of NIST 800-53, ISO 27001, SOC 2.
• Excellent verbal and written communication; clear security documentation.
• Strong interpersonal skills to collaborate with legal, HR, finance, IT and engineering.

Responsibilities

• Conduct third-party vendor risk assessments and internal risk evaluations; identify vulnerabilities and control gaps.
• Respond to vendor security questionnaires and support internal teams in security questions from prospects.
• Assist in tracking evidence for SOC 2 and ISO 27001 audits.
• Identify emerging threats and collaborate on practical security solutions.
• Coordinate and deliver security awareness training programs for employees.
• Ensure compliance with outside regulations affecting the Company.
• Collect and maintain security metrics for team dashboards.
• Partner with Legal, Engineering, IT, Finance, and HR to ensure policy understanding and adherence.
• Identify operational inefficiencies and help redesign workflows.

Skills

Vendor risk management

GRC

Security frameworks

Documentation

Stakeholder collaboration

Education

Bachelor’s degree in information security assurance, business management, or a related field

Job description

Responsibilities

• Conduct third-party vendor risk assessments and internal risk evaluations; identify, document, and report on potential vulnerabilities and control gaps.
• Respond directly to standard vendor security questionnaires and support internal teams (i.e. Sales, Customer Success, etc.) in answering security-related questions from prospects.
• Assist in tracking and collecting evidence for ongoing SOC 2 and ISO 27001 compliance audits.
• Proactively identify emerging threats and associated risks to existing business processes and corporate assets, and collaborate with senior team members to develop practical security solutions.
• Coordinate and deliver security awareness training programs to employees to foster a strong security culture.
• Assure compliance to outside regulations affecting the Company
• Collect and maintain impactful security and compliance metrics for team dashboards.
• Partner with Legal, Engineering, IT, Finance, and HR to ensure corporate security policies are understood and followed.
• Identify operational inefficiencies and areas for improvement in our existing security controls, and help design smoother workflows.

Requirements

• Bachelor’s degree in information security assurance, business management, or a related field
• 2-3 years of experience with third party risk management, GRC, customer due diligence, etc.
• Understanding of common security frameworks and principles (e.g. NIST 800-53, ISO 27001, SOC 2, etc). Strong organizational skills with the ability to manage tasks independently and meet deadlines with minimal oversight on daily routines.
• Excellent verbal and written skills; comfortable translating security concepts into clear documentation.
• Strong interpersonal skills with a track record of building positive relationships across non-technical teams (like Legal, HR, Finance) and technical teams (like IT and Engineering) to resolve security risks collaboratively.

Preferred Qualifications

• Prior experience working within a modern SaaS environment or cloud-first technology company, with a basic familiarity of how cloud applications operate.
• Prior knowledge of and skill in applying risk management principles and practices
• One or more preferred Certification(s): CRISC, CISSP, CISA, SSCP, CC, Security+, CySA+, etc.
• Basic understanding of cloud environments (AWS, GCP, or Azure).