Sr. Analyst, IT Security, Risk & Compliance

Prosum; Irvine (CA); Hybrid; USD 125,000 - 135,000; Full time

Job summary

Prosum in Irvine, CA is seeking a hands-on Sr. Analyst to lead IT security, risk, and compliance. The role requires owning the day-to-day IT security and GRC program, maintaining ISMS controls and risk registers, and coordinating audits and remediation efforts.

You will work with stakeholders, vendors, and a global parent organization to mature a cloud-based security program. Strong governance, documentation, and ownership are essential for success.

Qualifications

• 5+ years of IT Security, GRC, or related experience.
• Hands-on with security controls, audits, risk assessments, remediation.
• Familiarity with ISO 27001, NIST, SOC 2 or SOX ITGC.

Responsibilities

• Own day-to-day operation of the IT security and GRC program.
• Maintain ISMS, security controls, risk register, and control calendar.
• Coordinate control testing, access reviews, and audit readiness.
• Investigate security incidents and coordinate vulnerability remediation.
• Develop and maintain security policies, SOPs, and documentation.

Skills

IT Security

GRC

Audit & Compliance

ISO 27001

NIST/SOC 2/SOX ITGC

Microsoft 365

IAM / Entra ID

Cloud Security

Incident Response

Education

Bachelor's degree in CS/IS

Tools

Azure AD

Office 365

Risk Management Tools

Job description

## Sr. Analyst, IT Security, Risk & Compliance**Irvine,CA92606**Employment Type:PermJob Number: 25881Remote Options: Hybrid## Job DescriptionSr. Analyst, IT Security, Risk & Compliance **Irvine, CA | Hybrid – 2 days/week onsite | $125K–$135K + 10% bonus** We’re looking for a **hands-on IT Security, Risk & Compliance professional** to join a fast-growing, consumer-focused company that is actively building and maturing its security program. This is a great opportunity for someone who wants **real ownership and impact**. The security/GRC framework is being built today, so you’ll have the opportunity to come in during the implementation phase and help turn the framework into a practical, operational security program. What You’ll Do* Own the **day-to-day operation and execution** of the IT security and GRC program.* Operate and maintain the company’s **ISMS, security controls, risk register, compliance activities and control calendar**.* Coordinate and execute **control testing, access reviews, assessments and audit-readiness activities**.* Gather and validate audit evidence, maintain documentation and drive findings through remediation and closure.* Investigate and coordinate the response to **security incidents, vulnerabilities, access issues and security findings**.* Work closely with internal stakeholders, third-party security partners, vendors and the company’s global parent organization.* Develop and maintain security policies, SOPs, playbooks, control narratives and other security documentation.* Track security awareness, phishing education, compliance activities, remediation and overall security program health.* Identify opportunities to improve and mature the security program over time.What They’re Looking For* **5+ years** of experience in IT Security, GRC, Information Security, Security Compliance or a related area.* Hands-on experience with **security controls, audits, risk assessments, compliance, remediation and control testing**.* Experience with one or more frameworks such as **ISO 27001, NIST, SOC 2 or SOX ITGC**.* Strong understanding of **Microsoft 365, Entra ID/Azure AD, endpoint management, IAM, cloud security and security operations**.* Experience investigating or coordinating **security incidents and vulnerability remediation**.* Strong documentation, organization, communication and follow-through skills.* Someone who can **work independently, navigate ambiguity and figure things out without needing constant direction**.Why This Opportunity? This isn't a role where you'll simply maintain someone else's mature security program. The company is **actively building its security/GRC framework**, giving you the opportunity to help establish how the program operates, take ownership of the controls and processes, and play a meaningful role in its continued maturity. You'll also work in a **highly cloud-based, technology-driven environment** with significant exposure to third-party technology and security partners and a global parent organization. If you're a security/GRC professional who enjoys **ownership, problem-solving and building something rather than simply maintaining it**, this could be an excellent opportunity.