Information Security Analyst | GRC and Security Operations
I am an Information Security Analyst with experience across both the governance and the technical sides of security, which lets me translate between auditors, engineers, and leadership.
Governance, risk, and compliance:
• Vendor and third party security assessments, including SOC 2 report reviews• Built and own the standard vendor security review questionnaire used for all third party and AI tool evaluations• Security reviews of new tools and applications, including AI and other emerging technologies• Security policy development and review, risk assessment and treatment, and user access reviews, aligned to ISO 27001 practices• Primary point of contact during an external IT and security audit• Support for regulatory compliance, including DORA, and for incident response tabletop exercises
Technical security:
• Level three security investigations escalated from a third party SOC and endpoint detection and response platform• Phishing investigation and email security operations, including leading a full email security platform migration• Hands on experience with CrowdStrike, Okta, Vanta, Proofpoint, and IronScales• Documentation of investigations, incident updates, playbooks, and guides in Jira and Confluence
Security awareness:
• Own the company wide security awareness program: training, phishing simulations, newsletters, and post activity reporting for the team and leadership
Education and focus:
• MBA holder, deepening ISO 27001 knowledge through ongoing mentorship and building toward formal GRC certifications, with a habit of thinking about security in terms of business risk and strategy• Detail oriented, organized, and a clear communicator, comfortable working remotely with international teams across time zones
I am open to part time, full time, associate, or contract roles in information security and GRC.
