Security Compliance Analyst - Information Technology - Dallas

Winstead PC; Dallas (TX); On-site; USD 60,000 - 75,000; Full time

Job summary

Winstead PC is seeking a Security Compliance Analyst to support the organization's information-security compliance program. You will assist with security audits, client compliance requests, ISO processes, and vendor security reviews, collaborating with Engineering, Legal, Procurement, and other teams.

This role is ideal for someone early in their security or IT career who is organized, detail-oriented, and eager to learn about GRC activities, risk tracking, policy administration, and audit

Qualifications

• 0–2 years of experience or exposure to information security, IT, compliance, audit, risk management, or related functions.
• Strong organizational skills and attention to detail.
• Strong written and verbal communication skills.
• Ability to manage multiple tasks, track follow-ups, and meet deadlines with guidance.
• Proficiency with Microsoft Office, particularly Excel, Word, Outlook, and Teams.
• Willingness to learn security, compliance, vendor risk, and audit concepts.

Responsibilities

• Coordinate security audits by gathering evidence, tracking responses, and following up on open items.
• Respond to client security questionnaires and requests for information, with senior review.
• Serve as a point of contact for routine security-compliance questions.
• Maintain an organized repository of approved responses, policies, and audit records.
• Support the legal team during client security reviews and coordinate subject-matter-expert input.
• Identify recurring client requests and help update standard response materials.

Skills

Organizational skills

Written communication

Verbal communication

Time management

Education

Bachelor's degree

Tools

Microsoft Excel

Microsoft Word

Microsoft Outlook

Microsoft Teams

Job description

Position Summary

The Security Compliance Analyst supports the organization's information-security compliance program. Working closely with senior team members, this role assists with security audits, client compliance requests, ISO processes, and vendor security reviews.

This is an excellent opportunity for someone early in their security or IT career who is organized, detail-oriented, and eager to learn about security frameworks, vendor risk, and audit processes. You'll collaborate with teams across Engineering, Legal, Procurement, and beyond, while gaining exposure to governance, risk, and compliance (GRC) activities — including risk tracking, third-party risk management, policy administration, and compliance reporting — with guidance from senior staff.

Key Responsibilities

Audit & Client Compliance Support

• Coordinate security audits by gathering evidence, tracking responses, and following up on open items.
• Respond to client security questionnaires and requests for information, with senior review.
• Serve as a point of contact for routine security-compliance questions.
• Maintain an organized repository of approved responses, policies, and audit records.
• Support the legal team during client security reviews and coordinate subject-matter-expert input.
• Identify recurring client requests and help update standard response materials.

ISO Compliance Program Support

• Help maintain ISO compliance processes (e.g., ISO/IEC 27001) and keep ISMS documentation current.
• Support internal reviews, audits, and continual-improvement activities.
• Monitor updates to security standards and customer requirements.
• Maintain compliance calendars and track corrective actions, remediation, and audit findings.
• Support policy lifecycle activities, including periodic review, version control, approval tracking, and publication.

Engineering & Security Control Support

• Work with Engineering, IT, and Product teams to understand systems and data flows.
• Document and track security controls (access/identity management, change management, vulnerability and patch management, logging/monitoring, incident response, encryption, and backup/disaster recovery).
• Help identify control gaps, track remediation with technical owners, and prepare audit-ready evidence.

Vendor Security & New Vendor Intake Support

• Review vendor security documentation (questionnaires, SOC reports, ISO certificates) and document any gaps.
• Maintain a centralized inventory of vendors, applications, and SaaS services, including risk level and review status.
• Support periodic vendor reassessments and track review schedules.
• Help ensure new-vendor security reviews are completed and documented before access is granted.
• Escalate higher-risk or unclear vendor situations to senior team members.

GRC Program Support

• Maintain risk registers, compliance records, and security program documentation.
• Document security processes, workflows, and procedures for consistent execution.
• Support periodic risk assessments and maintain security metrics, dashboards, and recurring reporting.
• Identify process-improvement and automation opportunities across compliance and security operations.

Qualifications

Required

• Relevant experience is highly valued and may be considered in lieu of a degree.
• 0–2 years of experience or exposure to information security, IT, compliance, audit, risk management, or related functions (including internships, academic projects, or entry-level roles).
• Strong organizational skills and attention to detail.
• Strong written and verbal communication skills.
• Ability to manage multiple tasks, track follow-ups, and meet deadlines with guidance.
• Proficiency with Microsoft Office, particularly Excel, Word, Outlook, and Teams.
• Willingness to learn security, compliance, vendor risk, and audit concepts.
• Ability to handle sensitive and confidential information professionally.

Preferred

• A bachelor's degree in Information Security, Cybersecurity, IT, Business, Risk Management, or a related field is a plus but not required — equivalent hands-on experience is weighed equally or higher.
• Entry-level certifications such as CompTIA Security+, ISC2 Certified in Cybersecurity (CC), ISO 27001 Foundation, or Microsoft Security Fundamentals (or willingness to pursue them).
• Familiarity with common frameworks such as ISO 27001, ISO 27701, SOC 2, or the NIST Cybersecurity Framework.
• Experience maintaining documentation, inventories, records, or audit-related materials.
• Interest in GRC, Third-Party Risk Management (TPRM), privacy, or information security.

Core Competencies

• Strong organization and attention to detail
• Clear written and verbal communication
• Eagerness to learn security and compliance concepts
• Reliability and follow-through
• Ability to work well with a team
• Discretion when handling sensitive information

Success Measures

• Reliable, timely, and accurate evidence gathering for audits.
• Well-organized client security and ISO compliance documentation.
• Effective collaboration with Engineering and other teams.
• Consistent support for vendor security reviews and accurate vendor inventories.
• Clear tracking and follow-up of findings, risks, and remediation.
• Growing knowledge and increasing independence over time.