Security Analyst III Raleigh, NC

Lucid; Raleigh (NC); Hybride; USD 110 000 - 140 000; Plein temps

Résumé du poste

Lucid Software is seeking a Security Analyst to protect corporate assets, web applications, and employees. You will drive day-to-day GRC operations, third-party risk assessments, and support audits for SOC 2 and ISO 27001 while advocating a culture of security awareness.

You will partner with Legal, Engineering, IT, Finance, and HR to implement practical security controls, measure risk, and ensure regulatory compliance across the company.

Qualifications

• 3+ years of experience with third party risk management, GRC, customer due diligence, etc.
• Understanding of security frameworks and principles (NIST 800-53, ISO 27001, SOC 2, etc).
• Excellent verbal and written skills; clear documentation.
• Strong interpersonal skills across non-technical and technical teams.

Responsabilités

• Conduct third-party vendor risk assessments and internal risk evaluations; identify vulnerabilities and control gaps.
• Respond to vendor security questionnaires and support internal teams in security questions.
• Track and collect evidence for SOC 2 and ISO 27001 audits.
• Identify threats and collaborate to develop practical security solutions.
• Coordinate and deliver security awareness training programs for employees.
• Ensure compliance with external regulations affecting the company.
• Collect and maintain security and compliance metrics for dashboards.
• Partner with Legal, Engineering, IT, Finance, and HR to ensure security policies are understood.
• Identify inefficiencies and help design smoother security workflows.

Connaissances

Vendor risk assessment

GRC

Security concepts

Documentation

Interpersonal skills

Formation

Bachelor's in information security or related

Outils

NIST 800-53

ISO 27001

SOC 2

Cloud platforms (AWS/GCP/Azure)

Description du poste

Lucid Software is the leader in AI-driven work acceleration, helping teams see and build the future by turning ideas into reality. Its products include the Lucid Visual Collaboration Suite (Lucidchart and Lucidspark) and airfocus. The Lucid Visual Collaboration Suite, combined with powerful accelerators for cloud and process transformation, empowers organizations to streamline work, foster alignment, and drive business transformation at scale. We hold true to our core values: innovation in everything we do, passion & excellence in every area, individual empowerment, initiative and ownership, and teamwork over ego. At Lucid, we value diverse perspectives and are dedicated to creating an environment and culture that is respectful and inclusive for everyone. Lucid is a hybrid workplace. We promote a healthy work-life balance by allowing employees to work remotely, from one of our offices, or a combination of the two depending on the needs of the role and team.

As a Security Analyst at Lucid Software, you will protect our corporate assets, world-class web applications, and employees. You will focus on the execution of day-to-day GRC (Governance, Risk, and Compliance) operations, third-party risk assessments, and championing customer trust. Lucid Software’s security team fosters an environment where business and development can quickly adapt and innovate. We stay abreast of evolving security, legal, and business requirements through a risk and compliance mindset. Our mission is to protect and support the objectives of the business.

Responsibilities:

• Conduct third-party vendor risk assessments and internal risk evaluations; identify, document, and report on potential vulnerabilities and control gaps.
• Respond directly to standard vendor security questionnaires and support internal teams (i.e. Sales, Customer Success, etc.) in answering security-related questions from prospects.
• Track and collect evidence for ongoing SOC 2 and ISO 27001 compliance audits.
• Proactively identify emerging threats and associated risks to existing business processes and corporate assets, and collaborate with senior team members to develop practical security solutions.
• Coordinate and deliver security awareness training programs to employees to foster a strong security culture.
• Assure compliance to outside regulations affecting the Company
• Collect and maintain impactful security and compliance metrics for team dashboards.
• Partner with Legal, Engineering, IT, Finance, and HR to ensure corporate security policies are understood and followed.
• Identify operational inefficiencies and areas for improvement in our existing security controls, and help design smoother workflows.

Requirements:

• Bachelor’s degree in information security assurance, business management, or a related field
• 3+ years of experience with third party risk management, GRC, customer due diligence, etc.
• Understanding of common security frameworks and principles (e.g. NIST 800-53, ISO 27001, SOC 2, etc). Strong organizational skills with the ability to manage tasks independently and meet deadlines with minimal oversight on daily routines.
• Excellent verbal and written skills; comfortable translating security concepts into clear documentation.
• Strong interpersonal skills with a track record of building positive relationships across non-technical teams (like Legal, HR, Finance) and technical teams (like IT and Engineering) to resolve security risks collaboratively.

Preferred Qualifications:

• Prior experience working within a modern SaaS environment or cloud-first technology company, with a basic familiarity of how cloud applications operate.
• Prior knowledge of and skill in applying risk management principles and practices
• One or more preferred Certification(s): CRISC, CISSP, CISA, SSCP, CC, Security+, CySA+, etc.
• Strong understanding of cloud environments (AWS, GCP, or Azure).
• Experience with process improvement, efficiency enhancements, and automation of GRC and Security Assurance functions. Ability to use AI tools to enhance and enable work flows and automation.

#LI_DA1

Voluntary Self-Identification

For government reporting purposes, we ask candidates to respond to the below self-identification survey.Completion of the form is entirely voluntary. Whatever your decision, it will not be considered in the hiringprocess or thereafter. Any information that you do provide will be recorded and maintained in aconfidential file.

As set forth in Lucid Software’s Equal Employment Opportunity policy,we do not discriminate on the basis of any protected group status under any applicable law.

If you believe you belong to any of the categories of protected veterans listed below, please indicate by making the appropriate selection.As a government contractor subject to the Vietnam Era Veterans Readjustment Assistance Act (VEVRAA), we request this information in order to measurethe effectiveness of the outreach and positive recruitment efforts we undertake pursuant to VEVRAA. Classification of protected categoriesis as follows:

A \"disabled veteran\" is one of the following: a veteran of the U.S. military, ground, naval or air service who is entitled to compensation (or who but for the receipt of military retired pay would be entitled to compensation) under laws administered by the Secretary of Veterans Affairs; or a person who was discharged or released from active duty because of a service-connected disability.

A \"recently separated veteran\" means any veteran during the three-year period beginning on the date of such veteran's discharge or release from active duty in the U.S. military, ground, naval, or air service.

An \"active duty wartime or campaign badge veteran\" means a veteran who served on active duty in the U.S. military, ground, naval or air service during a war, or in a campaign or expedition for which a campaign badge has been authorized under the laws administered by the Department of Defense.

An \"Armed forces service medal veteran\" means a veteran who, while serving on active duty in the U.S. military, ground, naval or air service, participated in a United States military operation for which an Armed Forces service medal was awarded pursuant to Executive Order 12985.