Information Security Analyst

Summary

ACES Quality Management is on a mission to improve quality, confidence, and transparency across the financial services industry. Through our leading quality management platform, we empower clients to strengthen performance and stay ahead of risk. What sets us apart is our people - an engaged, high-performing, remote team that shows up for our customers and each other every day.

The Information Security Analyst is responsible for the day-to-day security of ACES systems and information assets, owning the operation of ACES security and compliance platforms and running the vulnerability, detection-review, and penetration-testing programs under the direction of the VP, Cloud & Platform Engineering. This role administers and evidences the security tooling, turns its output into clear analysis and recommendations, operates and evidences the SOC 2 security controls, and serves as technical subject-matter expert to the Vendor Management team and to auditors on security controls. The Information Security Analyst protects against unauthorized access, use, disclosure, disruption, modification, and destruction of organizational data. This is a mid-level, hands-on role: it prepares security proposals for management approval rather than approving them, and it does not run the compliance program or own security policy. Scope phases in deliberately, starting with platform administration and moving toward application security and judgment calls as the analyst builds context.

Essential Functions / Responsibilities

Reasonable accommodations may be made to enable individuals with disabilities to perform the essential functions

• Administers and maintains the security and compliance platforms that protect ACES information assets and technology infrastructure: Veracode (SAST/SCA), StackHawk (DAST), AlertLogic (MDR and WAF), Secureframe (platform administration, integrations, and evidence feeds), KnowBe4, and Microsoft Defender/Intune security configuration

• Protects organizational systems and data against unauthorized access, use, disclosure, disruption, modification, and destruction

• Tracks vulnerability remediation against SLAs, monitors new CVEs and known-exploited vulnerabilities (KEV) against the ACES environment, and recommends remediation actions

• Runs penetration-testing logistics: scoping documents, test-day preparation, findings tracking, and retest attestations

• Analyzes findings and prepares evidence-based proposals (exceptions, reclassifications, tooling changes) for management approval to strengthen the security posture

• Identifies non-compliant configurations and supports their remediation with the teams that own the fix

• Operates and evidences the SOC 2 security controls in the compliance platform (Secureframe), responds to auditor evidence requests, remediates exceptions on security controls, and joins auditor walkthroughs as subject-matter expert on those controls

• Runs the weekly review of MDR alerts and WAF activity, analyzing security events and escalating as appropriate; supports incident response with technical analysis and evidence handling

• Maintains current documentation of security procedures, platform configurations, and control evidence

• Collaborates cross-functionally with Technology, Engineering, and Operations teams to embed security and compliance requirements into systems and processes

• Acts as first responder to the Vendor Management team on technical items in customer security questionnaires and due-diligence requests, and drafts technical security reviews of third-party vendors