Note: The job is a remote job and is open to candidates in USA. LCvista is hiring an IT & Security Operations Analyst to run day-to-day IT, security, and compliance operations. The role supports the SOC 2 program, customer security reviews, vendor and employee lifecycle processes, and employees’ technical needs in partnership with the CTO, vCISO, and managed service provider.

Responsibilities

• Manage the day-to-day operations of our SOC 2 Type II program, including evidence collection, control monitoring, and auditor coordination
• Keep controls passing continuously throughout the year by monitoring control health in our compliance tooling and working with control owners to fix gaps quickly
• Coordinate the annual review and update of our security policies and procedures, in partnership with the vCISO
• Run periodic user access reviews across critical systems, including AWS, M365, and key SaaS applications, and keep evidence of completion
• Operate and document LCvista’s security program in our compliance platform (ControlMap), keeping policies, controls, and evidence current
• Run the employee security awareness program: onboarding training, annual training, phishing simulations, and tracking completion across employees and contractors
• Coordinate developer security training with Engineering
• Coordinate annual third-party penetration tests, including vendor scheduling and logistics, and track findings with Engineering through remediation and retest
• Track vulnerability prioritization and remediation with Engineering
• Support incident response activities and take part in tabletop exercises under the direction of the vCISO
• Stay current on security news, threats, and vulnerabilities, and flag relevant risks to the CTO and vCISO
• Manage the response process for customer and prospect security questionnaires, keeping answers accurate, consistent, and timely
• Build and maintain a reusable library of approved security answers and supporting documentation so response time drops as volume grows
• Support Sales, Customer Success, and Legal in reviewing security and data protection terms in customer contracts, flagging commitments that go beyond our current controls
• Partner with the CFOO and CTO to run security reviews and approvals for new vendors
• Review vendors’ security documentation, such as SOC 2 reports, questionnaires, and DPAs, and escalate risks to the CFOO and CTO
• Maintain an inventory of vendors and SaaS applications, including owners, data access, contract renewals, and periodic re-assessments
• Help teams understand and follow vendor management policies so new tools are adopted quickly and safely
• Serve as LCvista’s day-to-day point of contact for our MSP, tracking SLAs and making sure their work meets our security standards and SOC 2 requirements
• Manage onboarding, role changes, and offboarding for employees and contractors with the MSP and People Operations, including timely access provisioning and revocation and auditable records of every change
• Own the laptop lifecycle: procurement, inventory, shipping and setup with the MSP, recovery from departing employees, and secure end-of-life disposal with certificates of data destruction
• Work with the MSP and vCIO to make sure M365 and endpoint configurations meet our security standards, including MFA, encryption, patching, and EDR coverage
• Act as a technical resource for back-office tools, including M365, collaboration, HR, finance, and sales platforms. Help with configuration, user administration, and troubleshooting, and escalate to the MSP or vendors when needed
• Document common procedures and build self-service guides so recurring requests take less effort over time

Skills

• 3+ years of experience in IT operations, IT security, or compliance, ideally at a SaaS or technology company
• Hands-on experience supporting a SOC 2, ISO 27001, or similar audit, including evidence collection and control monitoring
• Experience completing customer security questionnaires or supporting security reviews
• A solid general technical background, including working knowledge of Microsoft 365 and Entra ID administration (users, groups, MFA, licensing)
• Experience managing IT asset or laptop lifecycles, from procurement through secure disposal
• Comfort administering and troubleshooting a range of SaaS business applications
• Familiarity with security fundamentals and frameworks, such as NIST CSF, CIS Controls, and OWASP
• Strong organizational skills and attention to detail, especially for tracking inventories, evidence, and vendor records
• Clear written and verbal communication skills, with the ability to explain technical and security topics to non-technical colleagues
• A service-oriented mindset and the ability to manage competing priorities across teams
• Must be currently authorized to work in the United States for any employer
• Experience with compliance automation platforms, such as Vanta, Drata, or ControlMap
• Experience with security awareness platforms, such as KnowBe4
• Experience running vendor risk management or third-party security review processes
• Familiarity with AWS security fundamentals, such as IAM, logging, and encryption
• Relevant certifications, such as CompTIA Security+, Network+, or Microsoft 365 Fundamentals/Administrator, or progress toward one
• Experience with questionnaire automation or trust center tools
• Basic scripting or automation skills (e.g., PowerShell, Python, or workflow tools like n8n or Power Automate)
• Experience with multi-tenant SaaS, compliance platforms, or edtech

Benefits

• Health, Dental, and Vision Insurance (100% paid premiums for employees, 80% paid for dependents with a buy-up plan option)
• HRA, FSA, HSA offerings
• Unlimited PTO & Sick/Wellness Hours
• Paid parental leave, paid medical leave
• 12 paid holidays + 2 flexible holidays
• 401k, Roth options
• Anniversary awards
• Laptop + keyboard with an annual work-from-home stipend to purchase equipment needed for home offices

Company Overview