15h Left : Senior InfoSec Compliance Analyst

The Senior InfoSec Compliance Analyst will play a pivotal role in ensuring that Onit adheres to industry standards and regulatory requirements. This position involves analyzing, implementing, and maintaining compliance protocols, collaborating with internal teams, and providing strategic insights to enhance our security posture.

Responsibilities :

• Lead the planning and execution of security audits (e.g., ISO 27001, SOC 2, PCI DSS, HIPAA, NIST, GDPR).
• Assess, implement, and maintain new compliance frameworks or controls, leading cross-functional projects for certifications or attestations (e.g., achieving new levels of SOC 2, ISO 27001, or industry-specific standards).
• Lead compliance-related projects, including process improvements, tool implementations (e.g., GRC platforms), and policy roll-outs.
• Oversee and coordinate penetration testing activities and manage third-party penetration testing vendors.
• Complete and manage responses to customer security and privacy questionnaires, providing evidence of controls to support sales.
• Perform risk assessments; document findings and collaborate with stakeholders to mitigate risks.
• Develop, review, and maintain security policies, procedures, and standards.
• Serve as the point of contact for compliance-related incidents and inquiries, conducting investigations and documenting findings.
• Support vendor management by performing third-party security assessments
• Mentor and coach junior analysts, promoting a team culture of knowledge-sharing and professional growth.

Qualifications / Skills

About Onit

Onit is a global leader in enterprise workflow solutions for legal, compliance, sales, IT, HR, and finance departments. With Onit, companies can transform best practices into smarter workflows, better processes, and operational efficiencies. Onit focuses on enterprise legal management, matter management, spend management, contract lifecycle management, and legal holds, transforming how global Fortune 500 companies and corporate legal departments bridge the gap between systems of record and systems of engagement.