Note: The job is a remote job and is open to candidates in USA. LCvista is hiring an IT & Security Operations Analyst to run day-to-day IT, security, and compliance operations. The role supports the SOC 2 program, customer security reviews, vendor and employee lifecycle processes, and employees’ technical needs in partnership with the CTO, vCISO, and managed service provider.
Responsibilities
- Manage the day-to-day operations of our SOC 2 Type II program, including evidence collection, control monitoring, and auditor coordination
- Keep controls passing continuously throughout the year by monitoring control health in our compliance tooling and working with control owners to fix gaps quickly
- Coordinate the annual review and update of our security policies and procedures, in partnership with the vCISO
- Run periodic user access reviews across critical systems, including AWS, M365, and key SaaS applications, and keep evidence of completion
- Operate and document LCvista’s security program in our compliance platform (ControlMap), keeping policies, controls, and evidence current
- Run the employee security awareness program: onboarding training, annual training, phishing simulations, and tracking completion across employees and contractors
- Coordinate developer security training with Engineering
- Coordinate annual third-party penetration tests, including vendor scheduling and logistics, and track findings with Engineering through remediation and retest
- Track vulnerability prioritization and remediation with Engineering
- Support incident response activities and take part in tabletop exercises under the direction of the vCISO
- Stay current on security news, threats, and vulnerabilities, and flag relevant risks to the CTO and vCISO
- Manage the response process for customer and prospect security questionnaires, keeping answers accurate, consistent, and timely
- Build and maintain a reusable library of approved security answers and supporting documentation so response time drops as volume grows
- Support Sales, Customer Success, and Legal in reviewing security and data protection terms in customer contracts, flagging commitments that go beyond our current controls
- Partner with the CFOO and CTO to run security reviews and approvals for new vendors
- Review vendors’ security documentation, such as SOC 2 reports, questionnaires, and DPAs, and escalate risks to the CFOO and CTO
- Maintain an inventory of vendors and SaaS applications, including owners, data access, contract renewals, and periodic re-assessments
- Help teams understand and follow vendor management policies so new tools are adopted quickly and safely
- Serve as LCvista’s day-to-day point of contact for our MSP, tracking SLAs and making sure their work meets our security standards and SOC 2 requirements
- Manage onboarding, role changes, and offboarding for employees and contractors with the MSP and People Operations, including timely access provisioning and revocation and auditable records of every change
- Own the laptop lifecycle: procurement, inventory, shipping and setup with the MSP, recovery from departing employees, and secure end-of-life disposal with certificates of data destruction
- Work with the MSP and vCIO to make sure M365 and endpoint configurations meet our security standards, including MFA, encryption, patching, and EDR coverage
- Act as a technical resource for back-office tools, including M365, collaboration, HR, finance, and sales platforms. Help with configuration, user administration, and troubleshooting, and escalate to the MSP or vendors when needed
- Document common procedures and build self-service guides so recurring requests take less effort over time
Skills
- 3+ years of experience in IT operations, IT security, or compliance, ideally at a SaaS or technology company
- Hands-on experience supporting a SOC 2, ISO 27001, or similar audit, including evidence collection and control monitoring
- Experience completing customer security questionnaires or supporting security reviews
- A solid general technical background, including working knowledge of Microsoft 365 and Entra ID administration (users, groups, MFA, licensing)
- Experience managing IT asset or laptop lifecycles, from procurement through secure disposal
- Comfort administering and troubleshooting a range of SaaS business applications
- Familiarity with security fundamentals and frameworks, such as NIST CSF, CIS Controls, and OWASP
- Strong organizational skills and attention to detail, especially for tracking inventories, evidence, and vendor records
- Clear written and verbal communication skills, with the ability to explain technical and security topics to non-technical colleagues
- A service-oriented mindset and the ability to manage competing priorities across teams
- Must be currently authorized to work in the United States for any employer
- Experience with compliance automation platforms, such as Vanta, Drata, or ControlMap
- Experience with security awareness platforms, such as KnowBe4
- Experience running vendor risk management or third-party security review processes
- Familiarity with AWS security fundamentals, such as IAM, logging, and encryption
- Relevant certifications, such as CompTIA Security+, Network+, or Microsoft 365 Fundamentals/Administrator, or progress toward one
- Experience with questionnaire automation or trust center tools
- Basic scripting or automation skills (e.g., PowerShell, Python, or workflow tools like n8n or Power Automate)
- Experience with multi-tenant SaaS, compliance platforms, or edtech
Benefits
- Health, Dental, and Vision Insurance (100% paid premiums for employees, 80% paid for dependents with a buy-up plan option)
- HRA, FSA, HSA offerings
- Unlimited PTO & Sick/Wellness Hours
- Paid parental leave, paid medical leave
- 12 paid holidays + 2 flexible holidays
- 401k, Roth options
- Anniversary awards
- Laptop + keyboard with an annual work-from-home stipend to purchase equipment needed for home offices
Company Overview