{"id":3407402,"url":"https://alion.io/job/aces-quality-management-information-security-analyst","title":"Information Security Analyst","company":{"id":2373566,"name":"ACES Quality Management","domain":"acesquality.com","url":"https://alion.io/company/acesquality","size_band":null,"is_staffing_agency":false,"employer_type":"direct","is_intermediary":false,"listed_via":null,"ats_vendor":"Paylocity","truth_index":null},"role":"Security","role_family":"Security","seniority":"middle","employment_type":"full_time","work_mode":"on_site","remote_scope":null,"remote_scope_basis":null,"remote_working_hours":null,"hiring_geo_confidence":"explicit","locations":["United States"],"countries":["US"],"hiring_countries":[],"hiring_countries_total":0,"salary":{"min":100000,"max":110000,"currency":"USD","period":"year","gross":null,"usd_annual":110000},"salary_estimate":null,"experience_years_min":3,"visa_sponsorship":false,"relocation_package":false,"has_equity":false,"technologies":[{"name":"Azure","optional":false},{"name":"KEV","optional":false},{"name":"Microsoft Defender","optional":false},{"name":"Platform Engineering","optional":false},{"name":"SOC 2","optional":false},{"name":"StackHawk","optional":false},{"name":"Veracode","optional":false},{"name":"Windows","optional":false}],"status":"live","first_seen_at":"2026-10-28T12:20:40Z","employer_posted_date":"2026-10-28","last_verified_at":"2026-11-05T11:29:36Z","board_verified":true,"closed_at":null,"days_open":8,"trust":{"level":"ok","repost_count":null,"flags":[],"days_open":8},"description":"Description\nSummary\nACES Quality Management is on a mission to improve quality, confidence, and transparency across the financial services industry. Through our leading quality management platform, we empower clients to strengthen performance and stay ahead of risk. What sets us apart is our people - an engaged, high-performing, remote team that shows up for our customers and each other every day.\nThe Information Security Analyst is responsible for the day-to-day security of ACES systems and information assets, owning the operation of ACES security and compliance platforms and running the vulnerability, detection-review, and penetration-testing programs under the direction of the VP, Cloud & Platform Engineering. This role administers and evidences the security tooling, turns its output into clear analysis and recommendations, operates and evidences the SOC 2 security controls, and serves as technical subject-matter expert to the Vendor Management team and to auditors on security controls. The Information Security Analyst protects against unauthorized access, use, disclosure, disruption, modification, and destruction of organizational data. This is a mid-level, hands-on role: it prepares security proposals for management approval rather than approving them, and it does not run the compliance program or own security policy. Scope phases in deliberately, starting with platform administration and moving toward application security and judgment calls as the analyst builds context.\nEssential Functions / Responsibilities\nReasonable accommodations may be made to enable individuals with disabilities to perform the essential functions\nAdministers and maintains the security and compliance platforms that protect ACES information assets and technology infrastructure: Veracode (SAST/SCA), StackHawk (DAST), AlertLogic (MDR and WAF), Secureframe (platform administration, integrations, and evidence feeds), KnowBe4, and Microsoft Defender/Intune security configuration\nProtects organizational systems and data against unauthorized access, use, disclosure, disruption, modification, and destruction \nTracks vulnerability remediation against SLAs, monitors new CVEs and known-exploited vulnerabilities (KEV) against the ACES environment, and recommends remediation actions \nRuns penetration-testing logistics: scoping documents, test-day preparation, findings tracking, and retest attestations\nAnalyzes findings and prepares evidence-based proposals (exceptions, reclassifications, tooling changes) for management approval to strengthen the security posture \nIdentifies non-compliant configurations and supports their remediation with the teams that own the fix \nOperates and evidences the SOC 2 security controls in the compliance platform (Secureframe), responds to auditor evidence requests, remediates exceptions on security controls, and joins auditor walkthroughs as subject-matter expert on those controls \nRuns the weekly review of MDR alerts and WAF activity, analyzing security events and escalating as appropriate; supports incident response with technical analysis and evidence handling \nMaintains current documentation of security procedures, platform configurations, and control evidence \nCollaborates cross-functionally with Technology, Engineering, and Operations teams to embed security and compliance requirements into systems and processes \nActs as first responder to the Vendor Management team on technical items in customer security questionnaires and due-diligence requests, and drafts technical security reviews of third-party vendors \nRequirements\nQualifications & Competencies\nWorking toward general independence in security and compliance work; able to manage moderately complex workstreams with decreasing need for direction \nSolid working knowledge of information security principles, risk assessment methodologies, and compliance frameworks \nAnalytical and detail-oriented; able to evaluate internal controls and operations and translate findings into practical recommendations \nFamiliarity with SOC 2 and with data protection laws and regulations applicable to financial services \nAbility to identify and assess non-compliant environments and support or lead remediation efforts \nClear and professional written and verbal communication skills; able to document security findings and present recommendations to technical and non-technical audiences \nCollaborative cross-functional partner; able to work effectively with Engineering, Technology, Operations, and Vendor Management teams on security and compliance matters \nCommitment to continuous learning; stays current on emerging threats, security technologies, and evolving compliance requirements \nRequired Education and Experience\nBachelor’s degree in Information Security, Computer Science, Information Technology, or a related field required, or equivalent work experience \n3-6 years of hands-on experience in information security, or in systems administration or infrastructure work with real security responsibility - reflecting mid-level positioning \nDemonstrated experience administering security or infrastructure tools in production: configuration, integrations, access control, troubleshooting, and vendor support \nExperience implementing security systems, configurations, or guidelines, including Windows and Microsoft 365 endpoint management (Defender, Intune, or comparable); familiarity with cloud infrastructure, Azure preferred\nExperience with vulnerability identification and driving remediation with the teams that own the fix \nFamiliarity with data protection regulations and compliance requirements in a technology or financial services context\nOne current security credential required: CompTIA Security+ or equivalent (e.g., ISC2 SSCP, GIAC GSEC, Microsoft AZ-500 or SC-200), or a commitment to earn Security+ within six months of start at ACES expense. CISSP, CISM, CISA, or similar are a plus, not required; experience leads \nSysadmins with security experience are welcome. \nPreferred: experience with Veracode, StackHawk, AlertLogic, Secureframe (or similar), or KnowBe4, and with supporting a SOC 2 Type 2 audit \nTravel Required\n0%-5% travel. Potential travel may include company or team meetings, audit engagements, and industry conferences as required.\nOther Duties\nPlease note this job description is not designed to cover or contain a comprehensive listing of activities, duties or responsibilities that are required of the employee for this job. Duties, responsibilities and activities may change at any time with or without notice.\nWork Authorization: Must be located in the United States of America and have work authorization documents to work in the United States of America.\nWe are an Equal Opportunity/Affirmative Action Employer. We will consider all qualified applicants for employment regardless of age, race, color, national origin, sex, religion, veteran status, disability, sexual orientation, gender identity, or any other legally protected status. We celebrate diversity and are committed to creating an inclusive environment for all employees.\nSalary Description\n$100,000 - $110,000 per year","description_format":"text","description_chars":7134,"description_truncated":false,"requirements":{"experience_years_min":3,"management_years_min":null,"team_size_min":null,"manages_managers":false,"education":{"level":"bachelor","optional":false},"security_clearance":false,"languages":[]},"benefits":["Continuous learning"],"hiring_locations":[{"name":"United States","iso":"US","kind":"country"}],"hiring_excludes":[],"relocation_offered":false,"industries":["Revenue Cycle & Medical Billing","Mortgage Lending & Brokers"],"lifecycle":[{"event":"open","at":"2026-10-28T16:40:19Z"}],"visa":[],"liveness":{"score":86,"band":"hot","label":"Hiring now","p_open":1,"p_active":0.86,"p_room":1,"age_days":7,"expected_fill_days":26,"reasons":["conf:0","win:early"],"computed_at":"2026-11-05T05:54:30Z"},"pay":{"stated_usd_annual":110000,"is_top_pay":false},"html_url":"https://alion.io/job/aces-quality-management-information-security-analyst","json_url":"https://alion.io/job/aces-quality-management-information-security-analyst.json","meta":{"generated_at":"2026-11-05T16:23:05Z","cache_seconds":300,"methodology":"https://alion.io/methodology","terms":"https://alion.io/terms","contact":"https://alion.io/contact","api":"https://alion.io/developers","about":"Alion is a live layer of people, companies and AI agents: who they are, whether they are real and active right now, what they do and how to work with them, readable by people and by agents and paid per call.","catalog":"https://alion.io/catalog.json","usage":{"tier":"crawler_verified","counted_by":"address","units_charged":1,"used_today":21521,"day_limit":null,"remaining_today":null,"minute_limit":300,"resets_at":"2026-11-06T00:00:00Z"}},"offers":[{"id":"company.slices","title":"One company in depth, by slice","status":"live","price":{"credits":0.02,"usd":0.002,"plus_per_slice":{"credits":0.05,"usd":0.005}},"unit":"per company, plus each slice with data","note":"the employer in depth","call":{"mcp_tool":"get_company","arguments":{"id":2373566},"rest":"https://alion.io/mcp/rest/get_company?id=2373566"},"human":"https://alion.io/catalog?offer=company.slices&for=job%2Faces-quality-management-information-security-analyst"},{"id":"market.stats","title":"A market slice: pay, demand and time to fill","status":"live","price":{"credits":1,"usd":0.1},"unit":"per slice","note":"pay, demand and time to fill for this role and place","call":{"mcp_tool":"market_stats"},"human":"https://alion.io/catalog?offer=market.stats&for=job%2Faces-quality-management-information-security-analyst"},{"id":"job.search","title":"Open jobs by role, technology, place, pay and visa","status":"live","price":{"credits":0.02,"usd":0.002},"unit":"per posting in a list","note":"similar open postings","call":{"mcp_tool":"search_jobs"},"human":"https://alion.io/catalog?offer=job.search&for=job%2Faces-quality-management-information-security-analyst"},{"id":"company.verify","title":"Is this company real and active right now","status":"pilot","price":null,"unit":"per company","request":{"url":"https://alion.io/catalog/request","method":"POST","body":"{\"offer\": \"company.verify\", \"for\": \"job/aces-quality-management-information-security-analyst\", \"note\": \"what you need it for\"}"},"human":"https://alion.io/catalog?offer=company.verify&for=job%2Faces-quality-management-information-security-analyst"}],"agent":{"mcp":"https://alion.io/mcp/jobs","mcp_open":"https://alion.io/mcp/open","next":[{"tool":"get_job","arguments":{"id":3407402}},{"tool":"search_jobs","arguments":{"company":"acesquality.com","detail":"compact"}},{"tool":"match_people","arguments":{"job_id":3407402},"note":"people open to offers who fit this vacancy"}],"note":"The same data through MCP tools: https://alion.io/mcp/open needs no sign-in (compact searches, postings, people); https://alion.io/mcp with an Alion account has everything. Docs: https://alion.io/developers"}}