Compliance and Security Analyst (IT)

About the role

The company is looking for an IT Compliance and Security Analyst with strong knowledge and hands-on experience in information security. The analyst manages compliance and security queries from internal teams and external customers, reviews each request, prepares accurate responses supported by policies and documentation, obtains CISO approval and shares the approved response with the requester.

Key responsibilities

• Receive and review compliance and security queries from internal stakeholders and external customers on documents, policies and services
• Assess each query using information security knowledge and confirm responses reflect security controls and practices
• Research queries and identify relevant policies, procedures, certifications and supporting evidence
• Draft clear responses, including security questionnaires, due-diligence requests and audit-related queries
• Share approved responses and documents with the requester within agreed timelines
• Maintain a tracker of requests with status, approvals and turnaround times
• Keep security and compliance documentation organized, version-controlled and up to date
• Coordinate with IT, Legal, HR and other teams to gather information and evidence
• Support internal and external audits, assessments and control reviews
• Identify recurring queries and help build a library of standard, pre-approved responses

Required profile

• Bachelor's degree in Information Security, Computer Science, Information Technology or a related field
• 3 to 5 years of experience in IT compliance, information security compliance, GRC or security assurance
• Strong written communication skills and attention to detail
• Ability to manage multiple requests and meet deadlines
• Certifications such as ISO 27001 Lead Implementer or Lead Auditor, CISA, CISM or Security+ are an advantage
• Experience with international or enterprise clients is an advantage

Required skills

• Security policies, risk management, security controls and best practices
• Frameworks and standards such as ISO 27001, SOC 2, NIST and GDPR
• IT controls: access management, change management, backup and disaster recovery, vulnerability management
• Customer security questionnaires and audit support