Security Risk Analyst

Audax Group; Boston (MA); On-site; USD 90,000 - 130,000; Full time

Job summary

Audax Group in Boston, MA seeks an Information Security Risk Analyst to drive the firm’s risk program across vendors, apps and internal systems. You will own risk assessments, document scoring, and support audit readiness with SOC 1/2 evidence collection and DDQs.

Join a collaborative team partnering with IT, Legal, Compliance and IR to translate technical controls into business risk narratives and enable secure, compliant operations.

Qualifications

• Experience applying NIST CSF, ISO 27001 and SOC 1/2 controls.
• Ability to perform risk assessments for vendors, applications and internal systems.
• Proven track record coordinating audits and DDQs.

Responsibilities

• Perform independent information security risk assessments for vendors, applications, systems and processes.
• Lead SOC 1 IT control evidence gathering across units.
• Coordinate audit requests and evidence collection.
• Develop risk narratives translating technical controls to business impact.
• Maintain risk registers and remediation tracking.
• Support BIA inputs and business continuity activities.

Skills

Risk frameworks

Third-party risk

Application risk

Control mapping

Audit coordination

SOC 1/2 controls

DDQs handling

Documentation

Business continuity

Threat intel basics

Tools

SIEM

EDR

Vulnerability scanning

Job description

Founded in 1999, Audax Group is a leading alternative investment manager with offices in Boston, New York, San Francisco, London and Hong Kong. With approximately $42 billion of assets under management and more than 475 employees, Audax is a leading capital partner for middle market companies, operating through three business lines: Audax Private Equity, Audax Private Debt, and Audax Strategic Capital.

The Information Security Risk Analyst owns and executes the risk assessment activities that drive the ongoing maturity of the firm's information security risk program. This role independently performs risk assessments of vendors, applications, and internal systems, and maintains the supporting artifacts needed to track remediation and report risk in a consistent, repeatable way. The position also leads SOC 1 IT control evidence collection, audit coordination, due diligence questionnaires, and change management control validation.

The Risk Analyst partners closely with IT, Legal, Compliance, IR, and business stakeholders to ensure security risks are identified, documented, communicated, and addressed through practical mitigation plans. This role helps improve audit readiness, supports investor and customer assurance needs, and enables the business to operate efficiently while meeting governance and security expectations.

RESPONSIBILITIES:

• Perform independent information security risk assessments for vendors, applications, systems, and business processes.
• Conduct application security vetting, including architecture reviews, control validation, and risk documentation.
• Apply consistent risk rating methodology (likelihood, impact, inherent, residual) and document scoring rationale.
• Partner with control owners to define practical remediation plans, including interim compensating controls.
• Facilitate recurring risk review check-ins with control owners to validate progress on remediation plans.
• Support risk exception and risk acceptance workflows (evidence collection, summaries, and tracking).
• Maintain and update risk registers, remediation tracking, and control mappings.
• Map assessment results to common security and control frameworks (e.g., NIST CSF, ISO 27001, SOC 1 & SOC 2).
• Contribute to policy, standard, and control development initiatives.
• Identify process improvements and support continuous improvement of GRC tooling.
• Contribute to documentation of SOPs, templates, and playbooks.
• Develop risk narratives that translate technical controls into business-relevant language.
• Support business continuity and resilience efforts (BIA input and tracking).
• Partner with business stakeholders to reduce onboarding cycle time through repeatable processes.
• Audit, Assurance & Investor Relations
  • Lead SOC 1 IT control evidence gathering across business units.
  • Coordinate internal and external audit requests and evidence collection.
  • Validate change management controls and ensure documentation supports audit requirements.
  • Improve audit preparedness and reduce last-minute evidence collection efforts.
  • Manage and respond to due diligence questionnaires (DDQs) from investors, customers, and partners.
  • Support initiatives that increase investor confidence in the security posture.
• Monitoring & Investigations
  • Perform departing employee forensic reviews in collaboration with IT and HR.
  • Monitor and triage at-risk employee email and activity alerts.
  • Coordinate and track PII removal management activities, working with third‑party providers and internal stakeholders.
  • Monitor and triage threat intelligence, digital risk protection (DRP) alerts, including brand impersonation, data exposure, and reputational threats, to identify new risks for assessment.

TECHNICAL QUALIFICATIONS:

• Strong understanding of risk management frameworks (NIST CSF, ISO 27001, SOC 1/2 controls).
• Experience performing third‑party, application, and internal technology risk assessments using a consistent methodology (likelihood, impact, inherent, residual).
• Working knowledge of control frameworks and mapping (e.g.: NIST CSF, ISO 27001, SOC 1 ITGC, SOC 2).
• Familiarity with application security concepts, including architecture patterns and common control areas (IAM, logging, encryption, vulnerability management), and documenting security risks clearly.
• Experience maintaining risk registers, remediation tracking, control mappings, and supporting evidence repositories.
• Understanding of change management controls and how to validate required documentation and approvals.
• Strong written risk documentation skills, including drafting risk narratives that translate technical control details into business impact.
• Comfort handling security questionnaires and assurance requests (DDQs), including collecting inputs and validating supporting artifacts.
• Baseline familiarity with security monitoring concepts and sources (SIEM alerts, EDR context, vulnerability scan outputs, threat intel