Job Title: Security Compliance Analyst
Location: REMOTE, US
Duration: 6 months, with a review near the end of the term to assess workload and any extension.
PR Range: $83/hr - $86/hr on W2
Job description
We seek a detail-oriented Security Compliance Analyst to provide hands-on administrative and program-management support for Security Compliance for approximately 6 months with the option to extend depending on new or increasing workload. The person will keep recurring reviews, audits, testing engagements, and customer security requests moving on schedule so Security Compliance specialists can focus on assessment, technical interpretation, and remediation efforts. The analyst will work with Security Compliance program owners and relevant cross-functional stakeholders under a defined intake and escalation process.
Responsibilities
Third-Party Security Questionnaire intake and response: Monitor assigned customer security questionnaire and document-request queues and relevant channel requests; acknowledge and categorize requests, identify DRIs and due dates, and route requesters to approved self-service materials where appropriate. Use the team’s questionnaire tool to generate draft responses, then validate them for completeness, accuracy, and consistency with approved security documentation; track DRI input and assemble approved artifacts. Initially, a Security Compliance employee will review the completed responses and approve delivery. After training and demonstrated accuracy, the contractor may independently review and deliver routine questionnaires within an agreed, documented scope. Escalate bespoke questions, uncertain or outdated answers, new security assertions, nonpublic disclosures, blockers, and deadlines to the appropriate Security Compliance employee or team DRI before delivery.
Quarterly Security Operational Reviews: Maintain the quarter-by-quarter calendar, control/evidence request list, templates, status tracker, evidence links, and follow-up log. Collect evidence from control owners, identify missing or late submissions, prepare review packets and draft administrative portions of the report, and track Security Compliance/PCI DRI review and approval. The Security Compliance reviewer remains responsible for examining evidence, documenting substantive conclusions, and verifying PCI DSS business-as-usual requirements.
Audit and penetration-test logistics: Maintain audit and test calendars, evidence/request trackers, and action logs; schedule walkthroughs from program-owner-approved attendee and scope lists; coordinate vendor meetings, access requests through approved channels, evidence deadlines, and follow-ups. Keep a clear record of what was requested, provided, reviewed, and still outstanding. Program owners retain audit scope, firm selection, SOW approval, findings, and responses.
Operational reporting and handoff: Produce a concise weekly view of open requests, aged items, upcoming milestones, unresolved decisions, and escalations. Document repeatable playbooks, templates, owners, and evidence locations to enable a clean handoff at contract end.
Qualifications:
Experience coordinating security compliance, audits, compliance operations, or customer security questionnaires; strong written communication, discretion with confidential information; strong program/project management backgrounds and general security familiarity; organized tracking and follow-through, and comfort coordinating across several teams and external parties.
Familiarity with PCI DSS, SOC1/2, and/or ISO 27001, audit evidence, and security questionnaires is preferred, but not required. The role requires reliable execution, sound escalation judgment, and coordination with employee owners for compliance determinations.
Decision and access boundaries: Security Compliance employees own control interpretation, evidence acceptance, substantive review findings, new customer-facing security assertions, non-routine disclosure decisions, and attestations.
Following training and authorization, the contractor may review and deliver routine questionnaire responses within the agreed scope.