Security Analyst

Description

Position Title

: Security Analyst
Department:

Technology
Reporting To

: VP of IT
Location

: Chicago Hybrid/Remote USA
About the Role:
Were looking for a hands-on Security Analyst to own our organizations day-to-day security posture — across our people, endpoints, software, and vendors. This role sits at the intersection of governance, technical security operations, and emerging AI risk. Youll be the person who knows where our exposure is, whos using what, and whether our controls actually hold up under testing.
We need someone comfortable both setting standards and getting into the weeds — reviewing a vendors SOC 2 report one hour, scoping a vulnerability scan the next, and evaluating whether a new AI tool an employee wants to use is safe to approve.
Employees located in the Greater Chicagoland Area or Dallas/Frisco area are currently expected to work from the office 1 day per week; however, this is subject to change.
What You’ll Do:
Employee & Endpoint Security
Monitor employee security practices, device compliance, and adherence to internal security policies
Maintain visibility into laptops, mobile devices, and endpoints — encryption status, EDR/antivirus coverage, and configuration drift
Manage identity and access controls (least privilege, MFA, offboarding, privileged access reviews)
Run security awareness training and phishing simulations
Software & Shadow IT Oversight
Maintain an inventory of software and SaaS tools in use across the organization, including unsanctioned ("shadow IT") applications
Evaluate and approve new software and AI tools before adoption, assessing data handling, permissions, and vendor risk
Track license and application sprawl as a security (not just cost) issue
AI Security
Stay current on AI-specific risks: prompt injection, data leakage through AI tools, model/vendor data retention policies, unsanctioned use of generative AI on sensitive data, and supply-chain risk in AI-powered products
Co-Develop and enforce acceptable-use policies for AI tools and copilots
Assess AI vendors and features embedded in existing software (e.g., new AI features rolled into SaaS products) for security implications
Third-Party & Vendor Risk
Conduct vendor security assessments and due diligence before and during engagements
Review vendor security documentation (SOC 2, ISO 27001 certifications, penetration test summaries, security questionnaires)
Maintain a third-party risk register and reassess periodically based on criticality and data access
Technical Security Operations
Coordinate or perform vulnerability scanning across infrastructure, endpoints, and applications
Manage or oversee penetration testing engagements (internal team or external vendors), track findings through remediation
Perform cyber risk assessments across systems, business units, and processes
Support incident response: detection, triage, containment, and post-incident review
Governance, Risk & Compliance
Maintain and mature the security program in alignment with frameworks such as NIST CSF/800-53, ISO 27001, SOC 2
Ensure practices support compliance with data privacy regulations including GDPR and CCPA/CPRA
Own or contribute to security policies, standards, and audit readiness
Report on security posture, risk, and metrics to leadership
Requirements
4+ years in information security, GRC, or senior analyst role
Working knowledge of NIST, ISO 27001, GDPR, and CCPA/CPRA requirements
Although we outsource these functions, familiarity with vulnerability scanning tools (e.g., Nessus, Qualys, Tenable); with penetration testing methodology (internal team or managing external testers); and with Security Operations functions (SOC) and how to work with our MSSP to mitigate and remediate events
Experience with endpoint management/MDM tools and understanding of laptop/device security controls
Familiarity with SaaS/vendor risk assessment processes
Emerging understanding of AI security risks and governance — you dont need to be an ML engineer, but you should be able to speak intelligently about the risks generative AI and AI-embedded tools introduce
Strong communication skills — able to translate technical risk into business terms for non-technical stakeholders
Comfortable balancing policy/governance work with hands-on technical review
Nice to Have:
Relevant certifications: CISSP, CISM, Security+, GSEC, CEH, or similar
Experience building or maturing a security program from an early stage
Although we are not regulated, prior experience in a regulated industry (finance, healthcare, or similar)
Why Join Us
Avant’s culture, the envy of the technology channel, is loaded with A players, self-starters and outgoing rockstars. We focus on empowering our staff to run and make decisions and as a company, we have 300+ people all moving in the same direction.
Our work-life balance is normal, benefits are competitive, and it is generally exciting to work for Avant.
Benefits
• Medical Insurance
• Dental Insurance
• Vision Insurance
• Commuter Benefits
• 401K Match
• Unlimited PTO
• Generous Parental Leave
The information contained in this job description is intended to convey information about the essential functions and requirements of the position. It is not an exhaustive list of the skills, efforts, duties, responsibilities or working conditions associated with the opportunity. In addition, the employee should be able to communicate effectively and in a constructive manner with management, peers, and coworkers.