Analyst, Security & Compliance

About the Role 

Decisions is looking for an Analyst, Security & Compliance to join our Compliance team. In this role, you'll help protect our products, data, employees, and customers by supporting security operations, vulnerability management, compliance programs, and audit activities. You'll work across Security, Engineering, IT, HR, and business teams to ensure security controls are operating effectively, risks are identified and remediated, and regulatory requirements are met.

You'll help support the organization's security posture and compliance objectives by managing security processes, coordinating audit activities, responding to security events, and driving continuous improvement across our security and compliance programs.

What You'll Own

• Own customer security questionnaires from intake through completion, including evidence gathering, review, and secure delivery.
• Manage vulnerability scanning activities and coordinate remediation efforts across products and systems.
• Review security scan results before releases and ensure critical and high-risk findings are routed appropriately.
• Help maintain strong external security ratings and continuously improve security posture.
• Participate in the incident response program and serve as Incident Response Coordinator when needed.
• Investigate employee-reported phishing attempts and coordinate remediation activities.
• Conduct phishing simulations and security awareness initiatives across the organization.
• Review software, vendor, and AI tool requests for compliance with company security policies.
• Maintain and update risk registers, security documentation, and compliance records.
• Partner with Engineering to support secure software development lifecycle (SDLC) requirements.
• Administer security awareness training programs and track completion metrics.
• Support least-privilege access reviews and security governance processes.
• Own and support compliance activities for PCI DSS, SOC 2 Type II, ISO 27001, and future compliance initiatives.
• Gather, review, organize, and manage audit evidence for external and internal audits.
• Communicate directly with auditors and stakeholders to resolve findings and action items.
• Execute assigned security controls and support internal control testing activities.
• Serve as backup owner for security and compliance controls managed by other team members.
• Track remediation efforts and ensure security and compliance commitments are completed on time.

What You Bring

• 2+ years of experience in information security, compliance, IT, risk management, or a related field.
• Experience supporting external audits such as SOC 2, ISO 27001, PCI DSS, or similar frameworks.
• Experience reviewing vulnerability scans and coordinating remediation with technical teams.
• Strong technical aptitude and comfort working in cloud platforms, identity management systems, and security tools.
• Ability to manage multiple priorities and meet deadlines in a fast-paced environment.
• Strong attention to detail and process-oriented mindset.
• Excellent written and verbal communication skills in English.
• Ability to work independently while collaborating across technical and non-technical teams.
• Sound judgment and problem-solving skills.
• Availability to work U.S. Eastern business hours and participate in an on-call rotation.

Bonus Points

• Experience with PCI DSS compliance programs, SAQs, or ROC assessments.
• Hands-on experience with EDR/XDR platforms such as CrowdStrike.
• Familiarity with SAST, DAST, or secure SDLC security practices.
• Experience administering GRC platforms, evidence repositories, or compliance management tools.
• Experience with Python, PowerShell, APIs, or security automation initiatives.
• Exposure to AI governance, ISO 42001, or AI risk management programs.
• Experience working with AWS, Azure, Linux, or cloud security controls.
• Security certifications such as CompTIA Security+, ISO 27001 Lead Auditor, or similar.

Benefits & Perks 

At Decisions, we want our employees to feel supported, connected, and able to do their best work. 

• Competitive compensation and performance-based incentives.  

• Comprehensive health and wellness benefits.  

• Flexible work environment with opportunities for remote or hybrid work.  

• Professional development, learning, and certification support.  

• Collaborative, high-growth culture with opportunities to make a meaningful impact.  

• Paid time off, company holidays, and employee recognition programs.