Security Analyst, Kin Insurance

• 3–5 years of experience in a cybersecurity, GRC, IT audit, or risk-focused security role
• Hands-on experience with controls testing, vendor security reviews, and cybersecurity risk assessments
• Familiarity with frameworks like NIST CSF, SOC2, PCI DSS, and relevant audit processes
• Experience with GRC tools (e.g., Drata, OneTrust, or similar platforms)
• Basic working knowledge of cloud platforms like AWS
• Excellent communication and documentation skills

Desirable

• Kin is seeking a Security Analyst to join our growing cybersecurity team
• This role is ideal for someone with a few years of hands-on experience in governance, risk, and compliance (GRC) or security operations, who’s ready to step into more responsibility while continuing to learn and grow
• You’ll focus on strengthening our cybersecurity controls testing, vendor risk management, and risk assessment processes, working closely with stakeholders across the business to support and scale our security program
• Cybersecurity Controls Testing
• Lead and support testing of internal controls across frameworks such as NIST CSF, SOC2, and PCI DSS
• Manage control evidence gathering and validation to support audits and continuous compliance
• Document results, track remediation efforts, and collaborate with teams to address gaps
• Cybersecurity Risk Management
• Maintain and update Kin’s cybersecurity risk register, supporting timely tracking and mitigation of key risks
• Conduct risk assessments for new technologies, vendors, and business processes
• Communicate risk findings effectively to technical and non-technical stakeholders
• Vendor Risk Management
• Own the vendor security review process, including assessing security documentation, assigning risk ratings, and following up on open items
• Partner with legal, procurement, and business units to ensure vendors meet Kin’s security standards
• Support automation and documentation of the third-party risk process in GRC tooling
• GRC Tooling and Operations
• Configure and optimize GRC platforms (e.g., Drata, OneTrust) to manage controls, assessments, and risk workflows
• Help integrate GRC tooling with other systems to improve visibility and reduce manual work
• Cloud Security & Control Validation
• Work with infrastructure and DevOps teams to validate cloud security controls in AWS, including IAM, networking, and logging
• Assist in maintaining documentation and mapping of technical controls to compliance requirements
• Awareness & Enablement
• Develop internal resources, communications, and training to help teams understand and meet security and compliance expectations
• Serve as a resource for security-related questions from teams across the business

• Deadline to Apply: June 30, 2025 at 4:00 AM UTC