CompassMSP

Security Analyst

• - Investigate, manage,respond to,and escalatesecurity alerts from various security platforms, such as EDR/XDR, SIEM, etc.
• - Analyze security events escalated from tier 1 tovalidatethreats and respond accordingly.
• - Investigate and respond to reported phishing emails.
• - Analyze, prioritize, and track vulnerabilitiesdetected by vulnerability scanners.
• - Researchemerging threatsand perform global threat huntsto support correlating industrydata and threat feeds with our clients’ environments andattack surfaces.
• - Conduct incident response procedures, investigatingindicators of compromise,identifyingroot causes, collecting evidence, anddrafting incident response reports.
• - Collaborate with othersecurityanalysts,compliance analysts,Compassengineers,andvCISOs,lendingthem yourtechnicalexpertisein ordertoprovide exceptional managed security services toour clients.
• - Interface directly with clients and end users wheninvestigating threats and managing/troubleshooting managed security tools.
• - Assistin the deployment of the managed security services toolstackto new clients.
• - Assistwithinternal quality projects, including developing standardsandsecurityservicesforCompassMSP.
• - Stay current with the latest industry trends, best practices, and regulatory requirements tohelpcontinuously enhance our securityservices.
• - Hunt for emerging threats using a combination ofmethods and tools such as SIEM querying, software testing, sandboxing, etc.Translate the results of threat hunts into actionable alerts andanalysisSOPs to aid the SOC in protecting clients.
• - Create andmaintaininternal standard operating procedures.
• - Participate in a flexible work schedule to includeafter hours/ on-call shifts.

Senior Security Analyst

Compliance

• The enterprise policy and ISMS framework. Control mapped, maintained in Vanta, and governed by a formal annual review and approval cycle.
• The enterprise risk register, the scoring methodology behind it, and quarterly risk reporting to the executive team and the board.
• The certification roadmap. SOC 2 Type II, then HITRUST CSF and PCI DSS, with ISO 27001 to follow. You select the auditors, run the programs, and deliver the opinions.
• The third party risk program, and a centralized response capability for inbound client security questionnaires across SIG Lite, CAIQ, and custom formats.
• Compliance-as-a-Service. A tiered, recurring compliance offering for our client base, from SOC 2 readiness at the SMB end through multi framework managed compliance at the enterprise end. You design it, launch it, and grow it.
• Compliance program support to our CMMC practice, which serves defense industrial base clients and is pursuing C3PAO authorization.
• A seat on the Security Steering Committee alongside the CEO, CFO, CTO, and VP of Operations.

Senior Security Analyst

Director, Governance, Risk & Compliance