Job description
It's fun to work in a company where people truly BELIEVE in what they're doing!
We're committed to bringing passion and customer focus to the business.
Job Description:
Security Operations & Tooling
Monitor, tune, and triage alerts across the SIEM platform, escalating confirmed incidents per established runbooks
Manage the vulnerability management lifecycle— including scanning, prioritization, remediation tracking, and executive reporting
Support endpoint security, email security, and network monitoring tools; identify gaps and recommend configuration improvements
Conduct periodic threat hunting activities and contribute to the development of detection rules and playbooks
Participate in incident response activities including containment, eradication, and post-incident reviews
Governance, Risk & Compliance (GRC)
Support ongoing SOC 2 Type II compliance efforts, including evidence collection, control testing, and coordination with external auditors
Assist with NIST CSF assessments — mapping current controls to framework functions and identifying gaps for remediation
Maintain and update security policies, standards, and procedures in collaboration with senior team members
Conduct periodic security risk assessments and contribute findings to the organization risk register
Track remediation efforts for identified risks and control deficiencies through to closure
Collaboration & Communication
Partner with IT, Engineering, and business stakeholders to embed security best practices into day-to-day operations
Assist in security awareness initiatives and provide guidance to staff on security topics
Prepare clear, concise reporting on security metrics, vulnerability status, and compliance posture for management
Qualifications
Required
3–5 years of experience in an information security role with exposure to both technical operations and compliance functions
Hands-on experience with SIEM platforms (Splunk, Microsoft Sentinel, or equivalent)
Working knowledge of vulnerability management tools such as Tenable Nessus/IO or Qualys
Demonstrated understanding of SOC 2 Trust Service Criteria and NIST Cybersecurity Framework
Familiarity with common attack techniques and defensive countermeasures (MITRE ATT&CK familiarity a plus)
Strong analytical and problem-solving skills with the ability to work both independently and collaboratively
Excellent written and verbal communication skills; ability to translate technical findings for non-technical audiences
Preferred
Relevant certifications such as CompTIA Security+, CySA+, CEH, CISM, or equivalent
Experience supporting a SOC 2 audit from end to end
Scripting or automation skills (Python, PowerShell) for security tooling and reporting
Exposure to cloud security (AWS, Azure, or GCP) environments
Experience working with GRC platforms (e.g., Archer, ServiceNow GRC, Drata, Vanta)
Originally posted on Himalayas
Who can apply
Eligible countries: United States. Accepted UTC offsets: UTC-10, UTC-9, UTC-8, UTC-7, UTC-6, UTC-5, UTC+14. Review the full description for employer-specific work authorization, residency and schedule requirements.