Security Analyst

AVANT Communications is hiring a Security Analyst to own the organization’s day-to-day security posture across employees, endpoints, software, vendors, and AI tools. The role combines security operations, governance, risk and compliance, vendor assessments, vulnerability management, and incident response.

Responsibilities:

• Monitor employee security practices, device compliance, and adherence to internal security policies
• Maintain visibility into laptops, mobile devices, and endpoints — encryption status, EDR/antivirus coverage, and configuration drift
• Manage identity and access controls (least privilege, MFA, offboarding, privileged access reviews)
• Run security awareness training and phishing simulations
• Maintain an inventory of software and SaaS tools in use across the organization, including unsanctioned ("shadow IT") applications
• Evaluate and approve new software and AI tools before adoption, assessing data handling, permissions, and vendor risk
• Track license and application sprawl as a security (not just cost) issue
• Stay current on AI-specific risks: prompt injection, data leakage through AI tools, model/vendor data retention policies, unsanctioned use of generative AI on sensitive data, and supply-chain risk in AI-powered products
• Co-Develop and enforce acceptable-use policies for AI tools and copilots
• Assess AI vendors and features embedded in existing software (e.g., new AI features rolled into SaaS products) for security implications
• Conduct vendor security assessments and due diligence before and during engagements
• Review vendor security documentation (SOC 2, ISO 27001 certifications, penetration test summaries, security questionnaires)
• Maintain a third-party risk register and reassess periodically based on criticality and data access
• Coordinate or perform vulnerability scanning across infrastructure, endpoints, and applications
• Manage or oversee penetration testing engagements (internal team or external vendors), track findings through remediation
• Perform cyber risk assessments across systems, business units, and processes
• Support incident response: detection, triage, containment, and post-incident review
• Maintain and mature the security program in alignment with frameworks such as NIST CSF/800-53, ISO 27001, SOC 2
• Ensure practices support compliance with data privacy regulations including GDPR and CCPA/CPRA
• Own or contribute to security policies, standards, and audit readiness
• Report on security posture, risk, and metrics to leadership

Requirements:

• 4+ years in information security, GRC, or senior analyst role
• Working knowledge of NIST, ISO 27001, GDPR, and CCPA/CPRA requirements
• Although we outsource these functions, familiarity with vulnerability scanning tools (e.g., Nessus, Qualys, Tenable); with penetration testing methodology (internal team or managing external testers); and with Security Operations functions (SOC) and how to work with our MSSP to mitigate and remediate events
• Experience with endpoint management/MDM tools and understanding of laptop/device security controls
• Familiarity with SaaS/vendor risk assessment processes
• Emerging understanding of AI security risks and governance — you don't need to be an ML engineer, but you should be able to speak intelligently about the risks generative AI and AI-embedded tools introduce
• Strong communication skills — able to translate technical risk into business terms for non-technical stakeholders
• Comfortable balancing policy/governance work with hands-on technical review
• Relevant certifications: CISSP, CISM, Security+, GSEC, CEH, or similar
• Experience building or maturing a security program from an early stage
• Although we are not regulated, prior experience in a regulated industry (finance, healthcare, or similar)