Security Compliance Analyst - Control Testing and Documentation

The Elite Job; Sedona (AZ); On-site; USD 85,000 - 130,000; Full time

Job summary

The Elite Job is seeking a Security Compliance Analyst to support regulatory compliance, risk management, and control testing activities. The role focuses on evaluating security controls, documenting testing results, and aiding internal and external audits.

Collaboration with IT, risk, legal, and operations teams is essential to ensure policy alignment and continuous improvement. The ideal candidate will translate technical requirements into clear compliance records, maintain evidence, and

Qualifications

• Bachelor-level education in IT or related field or equivalent practical experience.
• Foundational knowledge of information security principles and risk assessment.
• Familiarity with ISO 27001, SOC 2, NIST, CIS Controls.

Responsibilities

• Plan and execute security control testing to evaluate design and operating effectiveness.
• Collect, validate, and analyze evidence to determine control performance.
• Document testing methodologies, observations, results, and recommendations.
• Identify control deficiencies and remediation needs; follow up testing.

Skills

Information security

Regulatory compliance

Risk assessment

Documentation practices

Written communication

Audit coordination

Analytical skills

Attention to detail

Effective collaboration

Education

Bachelor's degree in IT / CS / Cybersecurity / Information Systems / Risk Management

Tools

Microsoft Excel

Microsoft Word

PowerPoint

Job description

Job Summary

The Elite Job is seeking a detail-oriented and analytical Security Compliance Analyst – Control Testing and Documentation to support the organizations information security, regulatory compliance, and risk management initiatives. The successful candidate will play an important role in evaluating security controls, maintaining compliance documentation, identifying control gaps, and ensuring that established security policies and procedures are implemented effectively. This position is responsible for conducting control assessments, gathering and reviewing evidence, documenting testing results, and supporting internal and external audits. The analyst will work closely with information technology, cybersecurity, risk management, legal, operations, and business teams to assess the effectiveness of security controls and ensure alignment with applicable regulatory requirements and industry standards. The ideal candidate should possess a strong understanding of information security principles, compliance frameworks, risk assessment methodologies, and documentation practices. They should be capable of translating technical security requirements into clear, structured compliance records that support informed decision-making and continuous improvement. This role offers an opportunity to contribute to a strong security culture, improve organizational accountability, and help protect sensitive business information, systems, and customer data.

Key Responsibilities

Security Control Testing and Assessment

• Plan and execute security control testing activities to evaluate the design and operating effectiveness of established security measures.
• Review access management, authentication, authorization, encryption, vulnerability management, logging, monitoring, backup, and incident response controls.
• Develop and follow structured testing procedures based on organizational policies, risk assessments, and applicable compliance requirements.
• Collect, validate, and analyze evidence to determine whether security controls operate as intended.
• Identify control deficiencies, implementation gaps, exceptions, and potential compliance risks.
• Document testing methodologies, observations, results, and recommendations in a clear and consistent format.
• Perform follow-up testing to verify that identified deficiencies have been appropriately addressed.

Compliance Documentation and Reporting

• Maintain accurate and up-to-date security compliance documentation, including control matrices, testing records, evidence registers, risk assessments, and remediation trackers.
• Prepare detailed control testing reports that communicate findings, risk levels, supporting evidence, and recommended corrective actions.
• Maintain documentation demonstrating compliance with applicable security policies, contractual obligations, and regulatory requirements.
• Organize compliance evidence to support internal audits, external audits, customer assessments, and certification activities.
• Review existing documentation for accuracy, completeness, consistency, and alignment with current organizational requirements.
• Track policy updates, control changes, and documentation revisions to ensure appropriate version control.
• Assist in preparing management reports, compliance dashboards, and periodic status updates.

Governance, Risk, and Compliance

• Support compliance activities related to recognized frameworks and standards, such as ISO/IEC 27001, SOC 2, NIST Cybersecurity Framework, and CIS Controls, where applicable.
• Assist in mapping organizational security controls to relevant framework requirements.
• Identify compliance gaps and collaborate with responsible teams to develop practical remediation plans.
• Maintain records of control owners, testing schedules, risk ratings, exceptions, and corrective actions.
• Support risk assessments by documenting potential threats, control weaknesses, business impacts, and mitigation measures.
• Monitor changes in security standards, internal policies, and relevant regulatory requirements.
• Help ensure that compliance activities are performed consistently and in accordance with approved procedures.

Audit and Stakeholder Coordination

• Coordinate with internal audit teams, external assessors, security engineers, IT administrators, and business stakeholders to obtain required compliance evidence.
• Respond to audit requests by locating, validating, and organizing relevant documentation.
• Participate in audit planning meetings, control walkthroughs, evidence reviews, and compliance discussions.
• Communicate control deficiencies and outstanding evidence requirements to the appropriate stakeholders.
• Follow up with control owners to monitor remediation progress and resolve documentation gaps.
• Maintain professional and constructive working relationships across departments.
• Support audit preparation activities and help ensure that records are available within agreed deadlines.

Continuous Improvement

• Recommend improvements to control testing procedures, documentation templates, evidence collection processes, and compliance workflows.
• Identify opportunities to automate repetitive compliance tasks and improve reporting efficiency.
• Contribute to the development and maintenance of security policies, standards, procedures, and control descriptions.
• Assist in improving the consistency and reliability of compliance reporting.
• Maintain awareness of emerging cybersecurity risks, control assessment practices, and compliance requirements.
• Promote accountability, transparency, and continuous improvement throughout the security compliance process.

Required Skills and Qualifications

• Bachelors degree in Information Technology, Computer Science, Cybersecurity, Information Systems, Risk Management, or a related discipline; equivalent practical experience may also be considered.
• Foundational knowledge of information security principles, cybersecurity risks, and organizational security controls.
• Understanding of security control testing, compliance assessments, audit evidence collection, and remediation tracking.
• Familiarity with compliance frameworks such as ISO/IEC 27001, SOC 2, NIST, or CIS Controls.
• Strong written communication skills, including the ability to prepare clear reports, testing records, and compliance documentation.
• Excellent analytical skills and the ability to identify inconsistencies, gaps, and potential control weaknesses.
• Strong organizational skills with the ability to manage multiple documentation requests and deadlines.
• Proficiency in Microsoft Excel, Word, PowerPoint, and other standard business productivity tools.
• Ability to review technical and procedural information and translate it into understandable compliance documentation.
• Strong attention to detail, accuracy, confidentiality, and professional integrity.
• Effective communication and collaboration skills when working with technical and non-technical stakeholders.
• Willingness to learn new compliance frameworks, security technologies, and assessment methodologies.
• Professional certifications such as ISO 27001 Lead Implementer, ISO 27001 Lead Auditor, Certified Information Systems Auditor (CISA), Certified in Risk and Information Systems Control (CRISC), or CompTIA Security+ are desirable but not mandatory unless required for a specific assignment.

Experience

Candidates with relevant experience in cybersecurity compliance, information security, IT auditing, risk management, quality assurance, or control documentation are encouraged to apply.
Entry-level candidates: Applicants with a relevant educational background, internship experience, academic projects, or foundational cybersecurity knowledge may be considered for junior-level opportunities.
Experienced candidates: Applicants with approximately 2–5 years of relevant experience may be well suited to roles involving independent control testing, audit coordination, compliance reporting, and remediation tracking. The exact experience requirement will depend on the positions seniority and business needs.

• Conducting security control assessments and documenting test results.
• Supporting ISO 27001, SOC 2, or other compliance and certification activities.
• Gathering evidence and responding to internal or external audit requests.
• Maintaining risk registers, control matrices, and compliance trackers.
• Reviewing access controls, security policies, operational procedures, and system configurations.
• Coordinating with technical teams to resolve control deficiencies.
• Using governance, risk, and compliance platforms or audit management tools.

Working Hours

• Employment schedule: Full-time, based on the agreed employment arrangement.
• Typical working hours: Approximately 8 hours per day, generally within a standard business schedule.
• Working days: Usually Monday to Friday, subject to company policy and client requirements.
• Work arrangement: On-site, hybrid, or remote, depending on the specific vacancy and operational needs.
• Flexibility: Occasional schedule adjustments may be required to support audit deadlines, compliance reviews, stakeholder meetings, or time-zone differences.
• Overtime: Additional hours may occasionally be necessary during major audit cycles or regulatory assessments, in accordance with applicable company policies and employment laws.
• The confirmed working schedule, time zone, and work arrangement will be communicated during the recruitment process.

Knowledge, Skills, and Abilities

Technical Knowledge

• Understanding of cybersecurity fundamentals, including confidentiality, integrity, and availability.
• Knowledge of access control, identity management, endpoint protection, vulnerability management, logging, encryption, and incident response concepts.
• Familiarity with control design, operating effectiveness, evidence validation, and remediation verification.
• Understanding of risk assessment principles and compliance documentation requirements.
• Awareness of information security standards, regulatory obligations, and internal governance procedures.

Analytical and Problem-Solving Skills

• Ability to compare control requirements against actual implementation and identify discrepancies.
• Capability to evaluate evidence objectively and document findings supported by facts.
• Ability to assess the potential business and security implications of control weaknesses.
• Confidence in prioritizing work according to risk, deadlines, and business impact.
• Willingness to investigate unclear findings and request additional evidence when necessary.

Documentation and Reporting Skills

• Ability to prepare structured, accurate, and audit-ready documentation.
• Strong written English skills for communicating findings and recommendations.
• Ability to maintain evidence logs, testing workpapers, compliance registers, and remediation trackers.
• Understanding of document version control, record retention, and confidentiality requirements.
• Ability to prepare concise summaries for management and detailed records for technical reviewers.

Communication and Collaboration

• Ability to work effectively with cybersecurity professionals, IT teams, auditors, and business stakeholders.
• Confidence in asking relevant questions and following up on incomplete evidence.
• Ability to explain compliance requirements in clear, practical language.
• Professional conduct when handling sensitive information and discussing control weaknesses.

Personal Attributes

• High attention to detail and a commitment to accuracy.
• Strong ethical judgment and respect for confidentiality.
• Self-motivation, accountability, and a proactive approach to work.
• Adaptability when policies, systems, or compliance requirements change.
• A continuous learning mindset and willingness to develop technical expertise.

Benefits

• Competitive compensation aligned with experience, qualifications, role responsibilities, and location.
• Opportunities for professional development through cybersecurity and compliance training.
• Support for relevant professional certifications, subject to eligibility and company policy.
• Potential remote or hybrid working flexibility for eligible positions.
• Opportunities to work with cross-functional teams on security, audit, and risk management initiatives.
• Exposure to recognized security frameworks and structured compliance processes.
• A collaborative environment that encourages knowledge sharing and continuous improvement.
• Opportunities to develop skills in governance, risk management, information security, and audit readiness.
• Potential performance-based recognition and career advancement opportunities.
• Applicable leave, insurance, retirement, and other employment benefits in accordance with the confirmed offer and local employment requirements.

Why Join The Elite Job

Joining The Elite Job as a Security Compliance Analyst offers an opportunity to contribute to the protection of business information and the improvement of organizational security practices. Make a meaningful security impact: Help strengthen security controls, improve compliance readiness, and reduce the risks associated with ineffective processes or inadequate documentation. Develop specialized expertise: Build practical experience in control testing, evidence validation, audit support, risk assessment, and compliance reporting. Work across business functions: Collaborate with IT, cybersecurity, risk management, operations, and audit stakeholders to understand how security requirements are implemented throughout an organization. Build a strong professional foundation: Develop transferable skills that can support future career opportunities in information security governance, risk and compliance, IT auditing, security assurance, and cybersecurity management. Contribute to continuous improvement: Help streamline compliance processes, improve documentation quality, and make control assessments more consistent and efficient. Grow through ongoing learning: Expand your knowledge of security standards, emerging risks, and evolving compliance expectations in a professional environment that values accuracy, accountability, and continuous development. The role is suitable for professionals who enjoy structured problem-solving, careful analysis, and helping organizations maintain effective security and compliance practices.