Security Compliance Analyst (100% Remote)

Our customer is an American financial services and digital payments company based in San Francisco, California. They’re working to help their diverse audiences — sellers, individuals, artists, fans, developers, and all the people in between — overcome barriers to access the economy.

We are seeking a highly motivated Security Compliance Analyst on a contract basis to help support our customer's business needs. This role is 100% Remote.

Overview:

• We seek a detail-oriented Security Compliance Analyst to provide hands-on administrative and program-management support for Security Compliance for approximately 6 months with the option to extend depending on new or increasing workload.
• The person will keep recurring reviews, audits, testing engagements, and customer security requests moving on schedule so Security Compliance specialists can focus on assessment, technical interpretation, and remediation efforts.
• The analyst will work with Security Compliance program owners and relevant cross-functional stakeholders under a defined intake and escalation process.

Responsibilities:

• Third-Party Security Questionnaire intake and response: Monitor assigned customer security questionnaire and document-request queues and relevant channel requests; acknowledge and categorize requests, identify DRIs and due dates, and route requesters to approved self-service materials where appropriate.
• Use the team’s questionnaire tool to generate draft responses, then validate them for completeness, accuracy, and consistency with approved security documentation; track DRI input and assemble approved artifacts.
• Initially, a Security Compliance employee will review the completed responses and approve delivery.
• After training and demonstrated accuracy, the contractor may independently review and deliver routine questionnaires within an agreed, documented scope. Escalate bespoke questions, uncertain or outdated answers, new security assertions, nonpublic disclosures and deadlines to the appropriate Security Compliance employee or team DRI before delivery.

Quarterly Security Operational Reviews:

• Maintain the quarter-by-quarter calendar, control/evidence request list, templates, status tracker, evidence links, and follow-up log.
• Collect evidence from control owners, identify missing or late submissions, prepare review packets and draft administrative portions of the report, and track Security Compliance/PCI DRI review and approval.
• The Security Compliance reviewer remains responsible for examining evidence, documenting substantive conclusions, and verifying PCI DSS business-as-usual requirements.
• Audit and penetration-test logistics: Maintain audit and test calendars, evidence/request trackers, and action logs; schedule walkthroughs from program-owner-approved attendee and scope lists; coordinate vendor meetings, access requests through approved channels, evidence deadlines, and follow-ups. Keep a clear record of what was requested, provided, reviewed, and still outstanding.
• Program owners retain audit scope, firm selection, SOW approval, findings, and responses.
• Operational reporting and handoff: Produce a concise weekly view of open requests, aged items, upcoming milestones, unresolved decisions, and escalations. Document repeatable playbooks, templates, owners, and evidence locations to enable a clean handoff at contract end.

Skills:

• Experience coordinating security compliance, audits, compliance operations, or customer security questionnaires.
• Strong written communication, discretion with confidential information; strong program/project management backgrounds and general security familiarity; organized tracking and follow-through, and comfort coordinating across several teams and external parties.
• Familiarity with PCI DSS, SOC1/2, and/or ISO 27001, audit evidence, and security questionnaires is preferred, but not required.
• The role requires reliable execution, sound escalation judgment, and coordination with employee owners for compliance determinations.

Decision and access boundaries:

• Security Compliance employees own control interpretation, evidence acceptance, substantive review findings, new customer-facing security assertions, non-routine disclosure decisions, and attestations.
• Following training and authorization, the contractor may review and deliver routine questionnaire responses within the agreed scope.
• Employee DRIs review exceptions before delivery. Client employees own purchase orders and vendor-invoice approvals.

Education:

• BS/MS Degree with relevant experience.

We offer a competitive salary range for this position. Most candidates who join our team are hired at the median of this range, ensuring fair and equitable compensation based on experience and qualifications.

Contractor benefits are available through our 3rd Party Employer of Record (Available upon completion of waiting period for eligible engagements)

Benefits: Medical, Dental, and 401k (no match)

An Equal Opportunity Employer. All qualified applicants will receive consideration for employment without regard to race, color, religion, sex, sexual orientation, gender identity, national origin, or protected veteran status and will not be discriminated against on the basis of disability.