Security Analyst

Position Title: Security Analyst

Department: Technology

Reporting To: VP of IT

Location: Chicago Hybrid/Remote USA

About the Role:

We're looking for a hands-on Security Analyst to own our organization's day-to-day security posture — across our people, endpoints, software, and vendors. This role sits at the intersection of governance, technical security operations, and emerging AI risk. You'll be the person who knows where our exposure is, who's using what, and whether our controls actually hold up under testing.

We need someone comfortable both setting standards and getting into the weeds — reviewing a vendor's SOC 2 report one hour, scoping a vulnerability scan the next, and evaluating whether a new AI tool an employee wants to use is safe to approve.

Employees located in the Greater Chicagoland Area or Dallas/Frisco area are currently expected to work from the office 1 day per week; however, this is subject to change.

What You’ll Do:

Employee & Endpoint Security

• Monitor employee security practices, device compliance, and adherence to internal security policies
• Maintain visibility into laptops, mobile devices, and endpoints — encryption status, EDR/antivirus coverage, and configuration drift
• Manage identity and access controls (least privilege, MFA, offboarding, privileged access reviews)
• Run security awareness training and phishing simulations

Software & Shadow IT Oversight

• Maintain an inventory of software and SaaS tools in use across the organization, including unsanctioned ("shadow IT") applications
• Evaluate and approve new software and AI tools before adoption, assessing data handling, permissions, and vendor risk
• Track license and application sprawl as a security (not just cost) issue

AI Security

• Stay current on AI-specific risks: prompt injection, data leakage through AI tools, model/vendor data retention policies, unsanctioned use of generative AI on sensitive data, and supply-chain risk in AI-powered products
• Co-Develop and enforce acceptable-use policies for AI tools and copilots
• Assess AI vendors and features embedded in existing software (e.g., new AI features rolled into SaaS products) for security implications

Third-Party & Vendor Risk

• Conduct vendor security assessments and due diligence before and during engagements
• Review vendor security documentation (SOC 2, ISO 27001 certifications, penetration test summaries, security questionnaires)
• Maintain a third-party risk register and reassess periodically based on criticality and data access

Technical Security Operations

• Coordinate or perform vulnerability scanning across infrastructure, endpoints, and applications
• Manage or oversee penetration testing engagements (internal team or external vendors), track findings through remediation
• Perform cyber risk assessments across systems, business units, and processes
• Support incident response: detection, triage, containment, and post-incident review

Governance, Risk & Compliance

• Maintain and mature the security program in alignment with frameworks such as NIST CSF/800-53, ISO 27001, SOC 2
• Ensure practices support compliance with data privacy regulations including GDPR and CCPA/CPRA
• Own or contribute to security policies, standards, and audit readiness
• Report on security posture, risk, and metrics to leadership