{"id":3898414,"url":"https://alion.io/job/bertram-capital-cybersecurity-analyst","title":"Cybersecurity Analyst","company":{"id":705592,"name":"Bertram Capital","domain":"bertramcapital.com","url":"https://alion.io/company/bertram-capital","size_band":"11-50","is_staffing_agency":false,"employer_type":"direct","is_intermediary":false,"listed_via":null,"ats_vendor":"Greenhouse","truth_index":{"grade":"B","score":75,"open_postings":4,"ghost_share":0,"stale_share":1,"repost_share":0,"time_to_fill_p50_days":null,"computed_at":"2026-11-07T05:47:08Z"}},"role":"Security","role_family":"Security","seniority":"junior","employment_type":null,"work_mode":"remote","remote_scope":"stated_countries","remote_scope_basis":"inferred_payroll_markers","remote_working_hours":null,"hiring_geo_confidence":"inferred","locations":[],"countries":[],"hiring_countries":["US"],"hiring_countries_total":1,"salary":{"min":120000,"max":150000,"currency":"USD","period":"year","gross":null,"usd_annual":150000},"salary_estimate":null,"experience_years_min":null,"visa_sponsorship":false,"relocation_package":false,"has_equity":false,"technologies":[{"name":"NIST CSF","optional":false},{"name":"SOC 2","optional":false},{"name":"AWS","optional":true},{"name":"Azure","optional":true},{"name":"GCP","optional":true},{"name":"Google Sheets","optional":true},{"name":"Google Workspace","optional":true},{"name":"Jira","optional":true},{"name":"Microsoft Excel","optional":true},{"name":"Monday.com","optional":true}],"status":"live","first_seen_at":"2025-02-27T14:16:05Z","employer_posted_date":"2026-11-06","last_verified_at":"2026-11-07T16:19:29Z","board_verified":true,"closed_at":null,"days_open":618,"trust":{"level":"stale","repost_count":0,"flags":["stale"],"days_open":617},"description":"Cybersecurity Analyst\nLocation:\nHybrid: Broomfield, Colorado or Foster City, California preferred\nThe team may also consider candidates to work remotely from the following states: California, Colorado, Idaho, Minnesota, Illinois, Massachusetts, Florida, New York, Wisconsin, Texas, Arizona, Indiana, or Ohio.\nFirm Overview \nBertram Capital is a private equity firm targeting investments in lower middle market companies. Since its inception in 2006, the firm has raised over $4B of capital commitments. Bertram has distinguished itself in the private equity community by combining venture capital operating methodologies with private equity financial discipline to empower its portfolio companies to unlock their full business potential. This approach is unique in that Bertram is not singularly focused on achieving its investment returns through financial engineering and the extraction of near-term cash flow. Instead, Bertram focuses on reinvestment and technology enablement to drive growth and value through digital marketing, e-commerce, big data and analytics, application development and internal and external platform optimization.\nVisit www.bcap.com for more information.\nPosition Description\nBertram Labs, the technology partner to Bertram Capital, is hiring a Cybersecurity Analyst focused on governance, risk, and compliance (GRC). You will help build and run our security program against the NIST Cybersecurity Framework (CSF) 2.0 and lead the day-to-day work of achieving and maintaining SOC 2 compliance. You will also work directly with each Bertram Capital portfolio company to make sure it meets the required framework.\nThis is an associate-level role for someone early in their security career who already speaks the language of frameworks. Your core strengths are organization, clear communication, and process discipline. You will turn framework requirements into policies, controls, evidence, and repeatable workflows, and you will work closely with Bertram Labs engineers, IT staff, external auditors, and business leaders.\nYou won't be doing this alone. You will work directly with our Cybersecurity Engineer to determine the right technical solutions and recommendations to meet the requirements of each security program. You will also work directly with our CISO, who provides oversight, to determine the correct remediation procedures and maturity level requirements for each portfolio company.\nResponsibilities\nGovernance (NIST CSF 2.0)\nMaintain our NIST CSF 2.0 Current and Target Profiles, and track gaps across all six Functions, with particular ownership of Govern (GV).\nDraft, update, and manage the review cycle for information security policies, standards, and procedures.\nMaintain the risk register: document risks, owners, treatment decisions, and due dates, and follow up until closed.\nMap controls across frameworks (NIST CSF, SOC 2, CIS Controls, ISO/IEC 27001) so one control satisfies many requirements.\nManage the firm's third-party supplier due diligence process (Bertram vendors only): collect vendor-supplied information (security questionnaires, SOC reports, policies, certifications), analyze it against the requirements of our due diligence process, and submit an analysis summary to the CISO, who approves or rejects the vendor.\nPortfolio company compliance\nOwn the security baseline for each portfolio company (a primary responsibility of this role). After an acquisition closes, support implementation of the CISO's initial analysis, then transition it into the company's security baseline and run the scheduled, recurring baseline reviews from there.\nWork directly with each portfolio company's leadership and IT teams to assess and track compliance with the required framework.\nRun framework gap assessments at each company and help build practical remediation plans.\nManually collect compliance data and evidence from each portfolio company, and track each company's status and open remediation items, and report progress to Bertram Labs leadership.\nShare policy templates, control guidance, and best practices so portfolio companies don't start from scratch.\nHelp each portfolio company establish its own third-party vendor due diligence program, including the process, templates, and review criteria. Each company runs its own reviews.\nSOC 2 compliance\nCoordinate SOC 2 readiness, the Type I audit, and ongoing Type II audit periods against the AICPA Trust Services Criteria.\nOwn the control inventory and evidence calendar: know which control needs which evidence, from whom, and when.\nCollect, organize, and quality-check audit evidence, and manage auditor requests through to closure.\nTrack exceptions and remediation items with control owners until they are fixed and re-tested.\nBuild and maintain the evidence tracker and repository by hand (spreadsheets and shared drives); we do not use an automated compliance platform.\nProcess and communication\nRun recurring control activities: access reviews, security awareness training, policy attestations, and tabletop exercises.\nTurn framework language into plain-English requirements engineers and business staff can act on.\nReport compliance status, open risks, and audit progress to Bertram Labs leadership in a clear, regular cadence.\nCollect the evidence the CISO needs to answer investor (LP) due diligence questionnaires (DDQs) and other security questionnaires.\nSupport incident response documentation and post-incident reviews as needed.\nPerform other duties and projects as assigned.\nQualifications\n0-3 years of experience in information security, GRC, IT audit, risk, or IT operations. Internships and relevant academic projects count.\nBachelor's degree in cybersecurity, information systems, computer science, or a related field, or equivalent practical experience.\nWorking knowledge of at least one major security framework (NIST CSF, NIST SP 800-53, ISO/IEC 27001, or CIS Controls) and how controls map between them.\nBasic understanding of SOC 2: what the Trust Services Criteria are, and the difference between a Type I and a Type II report.\nExceptional organization: you can track dozens of open items across many owners without dropping any.\nClear written and verbal communication, including the ability to explain security requirements to non-technical leaders.\nProcess mindset: you document how things are done, then make them repeatable.\nComfort with core IT concepts: identity and access management, endpoints, networks, and cloud services.\nPreferred Qualifications\nRelevant certifications, such as ISC2 CC, CompTIA Security+, ISACA CISA, or ISC2 CGRC.\nHands-on involvement in a SOC 2, ISO/IEC 27001, or similar audit, on either the company or the auditor side.\nStrong Excel or Google Sheets skills for building and maintaining compliance trackers. Exposure to compliance automation platforms (Vanta, Drata, or similar) is a plus.\nFamiliarity with public cloud environments (AWS, Azure, or Google Cloud) and Microsoft 365 or Google Workspace security settings.\nExperience with ticketing and project tools (Jira, monday.com, or similar) to run compliance work.\nCompensation and Benefits\nThe expected salary range for this position is: $120,000- $150,000 total annual compensation. Offered salary may be based on a variety of factors including skills, experience, and qualifications for the role. Other compensation includes profit sharing.\nComprehensive medical, dental, and vision benefits are provided at no cost to the employee. We offer a generous 401K match as well as a “take what you need” PTO policy.\nIf hired, employee will be in an “at-will position” and the Company reserves the right to modify base salary (as well as any other discretionary payment or compensation program) at any time, including for reasons related to individual performance, Company or individual department/team performance, and market factors.\nDiversity, Equity, and Inclusion\nAt Bertram Capital we value and celebrate the many perspectives that arise from a variety of cultures, genders, religions, national origins, ages, abilities, socioeconomic status and sexual orientation. Our commitment to Diversity, Equity and Inclusion (DEI) ensures that Bertram is a place that attracts, grows, and promotes top talent from all backgrounds.","description_format":"text","description_chars":8247,"description_truncated":false,"requirements":{"experience_years_min":null,"management_years_min":null,"team_size_min":null,"manages_managers":false,"education":{"level":"bachelor","optional":false},"security_clearance":false,"languages":[{"language":"English","level":"All levels","optional":false}]},"benefits":["401k plan","Equity"],"hiring_locations":[{"name":"United States","iso":"US","kind":"country"}],"hiring_excludes":[],"relocation_offered":false,"industries":["Cybersecurity","Information Security","Commerce","Professional Services"],"lifecycle":[{"event":"open","at":"2026-11-06T23:49:54Z"}],"visa":[],"liveness":{"score":5,"band":"cold","label":"Long shot","p_open":1,"p_active":0.175,"p_room":0.28,"age_days":617,"expected_fill_days":8,"reasons":["conf:1","win:tail","crowd:junior"],"computed_at":"2026-11-07T05:47:08Z"},"pay":{"stated_usd_annual":150000,"is_top_pay":true},"html_url":"https://alion.io/job/bertram-capital-cybersecurity-analyst","json_url":"https://alion.io/job/bertram-capital-cybersecurity-analyst.json","meta":{"generated_at":"2026-11-07T19:02:18Z","cache_seconds":300,"methodology":"https://alion.io/methodology","terms":"https://alion.io/terms","contact":"https://alion.io/contact","api":"https://alion.io/developers","about":"Alion is a live layer of people, companies and AI agents: who they are, whether they are real and active right now, what they do and how to work with them, readable by people and by agents and paid per call.","catalog":"https://alion.io/catalog.json","usage":{"tier":"crawler_verified","counted_by":"address","units_charged":1,"used_today":29290,"day_limit":null,"remaining_today":null,"minute_limit":300,"resets_at":"2026-11-08T00:00:00Z"}},"offers":[{"id":"company.slices","title":"One company in depth, by slice","status":"live","price":{"credits":0.02,"usd":0.002,"plus_per_slice":{"credits":0.05,"usd":0.005}},"unit":"per company, plus each slice with data","note":"the employer in depth","call":{"mcp_tool":"get_company","arguments":{"id":705592},"rest":"https://alion.io/mcp/rest/get_company?id=705592"},"human":"https://alion.io/catalog?offer=company.slices&for=job%2Fbertram-capital-cybersecurity-analyst"},{"id":"market.stats","title":"A market slice: pay, demand and time to fill","status":"live","price":{"credits":1,"usd":0.1},"unit":"per slice","note":"pay, demand and time to fill for this role and place","call":{"mcp_tool":"market_stats"},"human":"https://alion.io/catalog?offer=market.stats&for=job%2Fbertram-capital-cybersecurity-analyst"},{"id":"job.search","title":"Open jobs by role, technology, place, pay and visa","status":"live","price":{"credits":0.02,"usd":0.002},"unit":"per posting in a list","note":"similar open postings","call":{"mcp_tool":"search_jobs"},"human":"https://alion.io/catalog?offer=job.search&for=job%2Fbertram-capital-cybersecurity-analyst"},{"id":"company.verify","title":"Is this company real and active right now","status":"pilot","price":null,"unit":"per company","request":{"url":"https://alion.io/catalog/request","method":"POST","body":"{\"offer\": \"company.verify\", \"for\": \"job/bertram-capital-cybersecurity-analyst\", \"note\": \"what you need it for\"}"},"human":"https://alion.io/catalog?offer=company.verify&for=job%2Fbertram-capital-cybersecurity-analyst"}],"agent":{"mcp":"https://alion.io/mcp/jobs","mcp_open":"https://alion.io/mcp/open","next":[{"tool":"get_job","arguments":{"id":3898414}},{"tool":"search_jobs","arguments":{"company":"bertramcapital.com","detail":"compact"}},{"tool":"match_people","arguments":{"job_id":3898414},"note":"people open to offers who fit this vacancy"}],"note":"The same data through MCP tools: https://alion.io/mcp/open needs no sign-in (compact searches, postings, people); https://alion.io/mcp with an Alion account has everything. Docs: https://alion.io/developers"}}