Cybersecurity Compliance Analyst
$100k - $120k/yr
Mid
Bachelor's
Lafayette, CA, USA
HybridTwo days in the office and three days remote per week.
CybersecuritySecurity Governance, Risk & Compliance
About the job
Requirements
- Three or more years of combined experience in IT operations, cybersecurity, IT audit, or compliance, including at least one year supporting control assessments, audit evidence collection, or security documentation.
- Practical understanding of business IT environments, including identity and access management, endpoint security, email security, backups, networking, and cloud services.
- Experience reviewing technical configurations or administrative reports against documented standards.
- Working knowledge of the NIST Cybersecurity Framework and CIS Controls, with familiarity with NIST SP 800-53 and ISO/IEC 27001 control concepts.
- Strong writing skills and the ability to produce clear, accurate policies, procedures, assessment findings, and client documentation.
- Ability to distinguish documented policies from evidence that controls are implemented and operating.
- Strong organization, attention to detail, and the ability to manage deliverables across multiple clients.
- Ability to work independently on assigned tasks, identify questions or evidence gaps, and incorporate vCIO feedback.
- Professional communication skills and sound judgment when handling confidential client information.
- Ability to remain seated or standing at a workstation for extended durations, with regular breaks to prevent fatigue.
- Sustained ability to focus on a computer screen for tasks such as reading, typing, and data entry, with appropriate lighting and screen settings to reduce eye strain.
- Proficient use of hands and fingers to operate office equipment, including frequent alphanumeric keyboarding, mouse usage, and handling other peripherals.
- Ability to communicate clearly and effectively over the phone, video calls, and occasionally in person, requiring strong speech and active listening skills.
- Ability to handle and operate devices such as a mouse, headset, and other computer accessories with precision.
- Ability to adjust seating, monitor height, and other workstation elements to maintain comfort and reduce physical strain.
- Ability to maintain a workspace free from excessive noise and distractions to ensure focus and productivity.
- Ability to lift and move light objects, such as laptops, documents, and office supplies, as needed.
- Willingness and ability to travel to Xantrion's office or shared workspace as needed.
- Ability to follow company policies and procedures as well as all local, state, and federal laws.
- Ability to maintain confidentiality of company and customer records and information.
- Must have an existing cell phone running current Android or iOS.
- Must have a reliable, high-speed internet connection that supports work responsibilities, including video conferencing.
- Must have a dedicated, secure, and private workspace when working remotely.
- Must use the company-provided PC and headset to execute job functions.
Responsibilities
- Support current-state and target-state cybersecurity assessments using the NIST Cybersecurity Framework, CIS Controls, and company standards.
- Review IT configurations and supporting evidence against established templates and control requirements, and document gaps and findings for vCIO review.
- Draft and maintain incident response plans, business continuity plans, written information security programs, and supporting security policies and procedures.
- Support business impact analyses, risk and gap assessments, cybersecurity risk registers, and risk-acceptance records.
- Prepare control crosswalks, prioritized remediation roadmaps, executive risk summaries, and reporting scorecards under vCIO direction.
- Conduct vendor cybersecurity risk reviews by evaluating questionnaires, audit reports, security documentation, and supporting evidence.
- Maintain software and vendor inventories, data inventories, data flow documentation, and evidence indexes.
- Maintain annual testing schedules and track documentation, review dates, and follow-up items.
- Translate technical findings into clear descriptions of risk, supporting evidence, and recommended actions.
- Improve reusable templates and assessment procedures that support consistent delivery across clients.
- Use company-approved artificial intelligence tools to support research, analysis, and documentation while maintaining accuracy and protecting confidential information.
- Coordinate evidence collection and auditor requests for the company's annual SOC 2 Type II examination and ISO/IEC 27001 audit activities.
- Organize audit documentation, maintain request trackers, and follow up with internal control owners.
- Review evidence for completeness and consistency and identify missing or outdated documentation.
- Provide seasonal support during internal audit preparation and review periods.
- Follow and support company policies and procedures and applicable laws.
- Maintain a professional image in accordance with the company dress code.
- Use an existing or company-provided cell phone, internet connection, and home office equipment allowance as applicable.
- Use a secure, private remote workspace and company-provided computer and headset.
Desired Qualifications
- Experience supporting registered investment advisers or other financial services organizations.
- Familiarity with cybersecurity and information protection requirements relevant to financial services, including SEC Regulation S-P, the FTC Safeguards Rule under the Gramm-Leach-Bliley Act, and applicable FINRA requirements.
- Experience working for a managed service provider or supporting multiple client environments.
- Hands-on familiarity with Microsoft 365, Entra ID, Intune, and common endpoint and security management tools.
- Experience conducting vendor cybersecurity reviews and evaluating SOC 2 reports.
- Experience supporting SOC 2 Type II examinations or ISO/IEC 27001 audits.
- Familiarity with HIPAA, Criminal Justice Information Services, NIST SP 800-171, Cybersecurity Maturity Model Certification, or FedRAMP.
- Relevant certifications such as Security+, CGRC, CISA, or an ISO/IEC 27001 credential.
- Familiarity with AI governance, acceptable-use policies, and risks related to vendor data handling and access permissions.
- A relevant degree or certification; equivalent practical experience will be considered.
About the company
Xantrion is a cybersecurity and IT partner that protects and strengthens growing businesses through proactive, industry-focused managed security and supplemental IT services. It offers 24/7 technical support and tailoring of security solutions to each client’s needs, aiming to prevent issues and address them quickly as they arise. The company differentiates itself with a customer-centric, flexible approach built on more than 20 years of experience and a track record as a top MSSP for mid-market companies in the United States. Based in Lafayette, CA, Xantrion’s goal is to help clients build a secure, resilient tech ecosystem that scales with their business.
Company Size
51-200
Company Stage
N/A
Total Funding
N/A
Headquarters
Oakland, California
Founded
2000
Get referred to Xantrion
See people who can refer or advise you
Simplify's Take
What believers are saying
- 2026 MSP 501 recognition and 25th anniversary strengthen sales credibility with prospects.
- Current hiring in Lafayette and New York shows active expansion beyond California.
- AI governance and shadow-AI content indicate a timely wedge into budgeted security work.
What critics are saying
- No evidence of venture funding or scale moat; MSP commoditization pressures pricing.
- California concentration exposes Xantrion to local competition from larger national MSPs.
- Security failure or SOC 2 lapse would damage trust and blow up renewals fast.
What makes Xantrion unique
- 15 straight MSP 501 appearances and 2026 ranking #180 signal durable market credibility.
- Xantrion bundles managed IT, cybersecurity, compliance, and vCIO guidance for mid-market clients.
- California-focused delivery across San Francisco, San Jose, Los Angeles, Sacramento, and San Diego.
Help us improve and share your feedback! Did you find this helpful?
Benefits
- Health Insurance
- Dental Insurance
- Vision Insurance
- 401(k) Retirement Plan
- 401(k) Company Match
- Paid Vacation
- Professional Certification Support
- Professional Development Budget
- Employee Referral Bonus
- Phone/Internet Stipend
- Home Office Stipend