Junior Information Security & Compliance Analyst

About the Role

This is a deliberately structured entry-level role for a Junior Information Security & Compliance Analyst. The incumbent is not expected to arrive with deep security experience but is expected to be precise, persistent, and coachable, and to build real technical and audit depth on the job. Over time, this person should take full ownership of the recurring compliance calendar and become the company's second line of security response. This role is the execution engine of Veracity's security and compliance program, carrying recurring, deadline-driven work to keep the program credible and audit-ready.

Key Responsibilities

• Monitor security dashboards, alerts, and logs across AWS, Microsoft 365, Google Workspace, and Grafana – triage, document disposition, and escalate per established runbooks.
• Run recurring vulnerability scans across cloud, endpoint, and application surfaces – maintain the remediation tracker, drive follow-up with system owners, and verify and close findings within defined SLAs.
• Serve as first-line triage for employee-reported phishing and security questions – escalating confirmed issues promptly with context already gathered.
• Support incident response as first responder and scribe – capture the timeline, preserve evidence, maintain ticket hygiene, and draft the post-incident summary and lessons learned for senior review.
• Maintain coverage and health of security tooling including MFA enrollment, endpoint agents, logging agents, and email security – and report gaps.
• Execute user access provisioning, role changes, and deprovisioning tied to onboarding and termination – confirming same-day removal of access for departures.
• Run quarterly user access reviews end to end – pull system reports, distribute to owners, chase responses, document and route exceptions, and file completed evidence.
• Enforce least-privilege and role-based access practices in day-to-day requests – flagging standing privileges and orphaned accounts for remediation.
• Maintain accurate records of privileged accounts, service accounts, and third-party access across business units.
• Collect, organize, and continuously refresh audit evidence for SOC 2 and PCI DSS – owning the evidence repository.
• Support SOC 2 and PCI DSS audit cycles – track requests, meet internal due dates, and prepare materials for auditor communications.
• Maintain the policy and procedure library including version control, the annual review calendar, approval records, and employee attestation tracking.
• Support vendor risk assessments – collect SOC 2 reports, DPAs, and security questionnaires, maintain the vendor inventory, and flag gaps for senior review.
• Perform assigned internal control testing and document results with evidence.
• Draft responses to customer and carrier security questionnaires and diligence requests for review.
• Maintain the asset inventory and security awareness training program including completion tracking and follow-up.
• Build and maintain security and compliance metrics reporting – open vulnerabilities, SLA performance, access review status, and training completion.
• Write and maintain runbooks, SOPs, and checklists for recurring work.
• Partner with IT, Engineering, Compliance, Legal, and Service teams so that controls are applied consistently.
• Identify repetitive security and compliance tasks that can be automated or streamlined and propose improvements.
• Perform other duties as requested, directed, or assigned.

Requirements & Tech Stack

• Working familiarity with at least one major cloud or productivity platform – AWS, Microsoft 365/Azure, or Google Workspace – including where users, permissions, and logs live.
• Demonstrated ability to own recurring, detail-heavy work to completion without reminders.
• Comfort with spreadsheets, ticketing systems such as Jira, and documentation tools.
• Excellent verbal and written communication skills.
• Sound judgment and discretion handling sensitive, regulated, and confidential information.
• Coachability and genuine curiosity about security.

Qualifications

• 0–2 years of professional experience – internships, IT helpdesk or support, systems administration, or audit and compliance support all count.
• Bachelor's degree in Information Systems, IT, Cybersecurity, or a related field – or equivalent practical experience or a relevant certification in lieu of a degree.