Security Compliance Analyst

Risepoint assists primarily regional universities in increasing their access and impact by making their academic programs available to students online. Founded in 2007, Risepoint's mission is to expand access to high-quality, affordable, and workforce-relevant education, especially for working and adult students. Risepoint brings single-minded dedication to student success, an integrated set of services, and data-driven performance to our collaboration with university partners.

Risepoint is seeking a Security Compliance Analyst to ensure the organization adheres to both external regulatory requirements and internal policies. This critical role will focus on aligning the company's security and privacy practices with industry standards, legal frameworks, and best practices. The position will help safeguard sensitive data and mitigate risks associated with security and privacy breaches. This position will report to the Manager of Compliance and Data Privacy within the Business Technology department.

Key Responsibilities:

* Security and Privacy Audits: 20% Assist with comprehensive audits and assessments of security and privacy practices to ensure compliance with organizational policies and regulatory frameworks. Identify gaps, track implementation of corrective measures, and ensure continuous compliance improvement.

* Vendor Risk Management: 20% Assess and monitor third-party vendors to ensure their security and privacy practices align with company standards and regulatory requirements. Collaborate with stakeholders to mitigate risks associated with third-party services.

* Regulatory Compliance Monitoring: 10% Stay up to date on industry regulations, such as GDPR, CPRA, and CCPA, and ensure the organization maintains compliance. Interpret regulatory changes and provide actionable insights to adapt policies accordingly.

* Policy Implementation: 15% Track adherence to business security and privacy policies that comply with applicable laws and regulations, capture gaps in policy alignment, and track remediation activities.

* Risk Assessments: 15% Conduct thorough risk assessments to identify vulnerabilities, compliance gaps, and potential regulatory risks. Capture and track risk mitigation strategies to address identified issues.

* Training and Awareness Programs: 5% Assist with enforcement of privacy compliance training for employees. Ensure all staff are well-informed about compliance obligations and the importance of maintaining secure practices by completing all required trainings. Track and report on compliance training completion.

* Incident Investigations: 5% Participate in investigations into compliance breaches, security violations, or privacy incidents. Collaborate with key stakeholders to capture and track the implement corrective actions.

* Reporting and Documentation: 10% Prepare detailed reports on audit findings, compliance status, and incident

investigations. Maintain accurate and up-to-date documentation of policies, compliance activities, and corrective measures.

Skills and Competencies:

* Knowledge of Regulatory Frameworks: Understanding of legal, regulatory, and security frameworks such as GDPR, CCPA, CPRA, HIPAA, SOC 2, NIST CSF, and CIS Controls. Ability to interpret and apply these regulations to the organization's processes.

* Analytical Thinking: Strong ability to analyze complex information, identify patterns, and assess risks related to security and privacy practices.

* Attention to Detail: Exceptional precision in reviewing policies, procedures, and compliance documentation to ensure all standards are met without error.

* Project Management:

Self-motivated and can manage compliance projects, including planning, execution, and stakeholder coordination.

* Effective Communication: Strong verbal and written communication skills to convey complex compliance requirements and findings clearly to technical and non-technical stakeholders.

* Problem-Solving: Proficiency in identifying risks and recommending remediations to resolve compliance issues.

* Team Collaboration: Proven ability to work cross-functionally with IT, legal, and business teams to ensure integrated compliance efforts.

Qualifications:

* Education: Bachelor's degree in Information Technology, Computer Science, Cybersecurity, Privacy, or a related field. Relevant certifications (e.g., CIPP, CIPT, CISSP, CISA) are a strong advantage.

* Experience: 2-5 years of hands-on experience in security and privacy compliance, cybersecurity, or risk management. Demonstrated experience with security audit and managing regulatory compliance.

Risepoint is an equal opportunity employer and supports a diverse and inclusive workforce.