Security & Compliance Analyst

About the role

Graphite, a fully distributed technology-enabled growth agency, is looking for a mid-level Security & Compliance Analyst to support its security and compliance program. The role reports to the Director of Legal and works with Engineering, IT and Legal. It is fully remote and requires someone resourceful, detail-oriented and able to take full ownership of their work.

Key responsibilities

• Monitor and triage security alerts, escalating real issues
• Coordinate incident response from triage through post-mortem and run tabletop exercises
• Triage security advisories and vulnerabilities and track patching against remediation SLAs
• Maintain technical security controls, including encryption, key and certificate management and secrets rotation
• Review cloud and infrastructure configurations against security policies and follow up on fixes
• Run periodic checks (vulnerability scans, backup restores, access reviews) and collect SOC 2 evidence, including for failing Vanta tests
• Support vendor security reviews, client security questionnaires and GDPR work
• Report on the status of alerts, vulnerabilities and open compliance items

Required profile

• 3 to 5 years in a security operations, cybersecurity or security engineering role
• Working knowledge of SOC 2 and GDPR and audit processes
• Hands-on experience with log analysis, vulnerability management and incident response, including post-mortems
• Experience securing cloud infrastructure on AWS and GCP
• Nice to have: experience with Vanta or a similar compliance platform, and a certification such as Security+, CySA+ or CISSP (or Associate of ISC2)
• Excellent written and verbal English

What we offer

• Competitive pay and flexible PTO
• Healthcare coverage and education opportunities
• A distributed team across the US, Canada, LATAM and Europe
• Training in enterprise-grade compliance, audit and certification, emerging frameworks such as AI governance, and security at scale