EllisDon

Security Analyst

• Conduct IT audits, collect and validate evidence to support GRC program and audit readiness
• Support identification, assessment, and tracking of IT/cyber risks; maintain the enterprise risk register and remediation lifecycle
• Perform risk assessments for systems, projects, and vendors; support ongoing third-party compliance activities
• Contribute to GRC program operations (policies, standards, procedures, exception tracking, evidence workflows)
• Support remediation of risks, control gaps, and audit findings across teams
• Partner with IT (Service Delivery, Operations, DevOps) to enable secure system and solution implementation
• Support security awareness program, including training, reporting, and modern threat simulations (phishing, social engineering, AI-driven attacks)
• Support compliance across SOC 2, NIST, ISO 27001, and CMMC / CPCSC / ITSP, ensuring consistent control implementation
• Contribute to key GRC initiatives, including risk maturity, audit readiness, vendor compliance, and standardization of security requirements across the organization

Information Security Analyst