Security Operations & Risk Analyst

Nepc, Llc; Boston (MA); Hybrid; USD 81,000 - 108,000; Full time

Job summary

NEPC, LLC, a Boston-based investment consulting firm, is seeking an Information Security Analyst to join the department led by the Director of Information Security. The role focuses on security operations, investigations, and vulnerability follow-through, with governance and risk coordination as secondary responsibilities.

You will monitor alerts, coordinate remediation with IT and business partners, document findings, and support risk and compliance activities including the risk register and

Qualifications

• 3–5 years of information security experience.
• Certifications such as Security+, CySA+, CISSP or ISC2 noted.
• Associate degree preferred but not required.

Responsibilities

• Monitor, investigate, and triage security alerts, events, vulnerabilities.
• Coordinate remediation with IT, analysts, and stakeholders.
• Document investigatory steps, evidence, and remediation progress.
• Support vulnerability management activities and track overdue items.
• Maintain the risk register and document operational risks and control gaps.
• Assist with Operational Risk Council materials and audit evidence.
• Partner with Compliance on security and privacy requirements.
• Support procedures, policy updates, and security awareness.

Skills

Security operations

Threat triage

Vulnerability management

SIEM

Communication

Documentation

Procedural discipline

Endpoint protection

Vulnerability platforms

Ticketing systems

Dashboards

Education

Security certifications (Security+, CySA+, CISSP/ISC2)

Associate degree preferred

Tools

Endpoint protection

Vulnerability management platforms

SIEM

Ticketing systems

Dashboards

Job description

NEPC, LLC, a Boston-based investment consulting firm, is seeking an Information Security Analyst to join the department led by the Director of Information Security. The role focuses on security operations, investigations, and vulnerability follow-through, with governance and risk coordination as secondary responsibilities.

You will monitor alerts, coordinate remediation with IT and business partners, document findings, and support risk and compliance activities including the risk register and