InfoSec Compliance Analyst, Zus Health

• Organized, detail-oriented, and accountable — you take pride in running a tight ship
• Strong project and documentation skills; you can wrangle chaos into a crisp Confluence page and clearly defined Jira tickets
• Familiarity with SIEM tools
• Fast and effective: you know how to move things forward without overcomplicating them
• A self-starter attitude that shows that you are ready for the fast, and sometimes unstructured nature of an early startup

Desirable

• We are looking for an InfoSec Compliance Analyst to support and mature our InfoSec and Compliance programs. This role is perfect for someone who is process-driven, organized, and curious — with an eye for documentation, systems, and continuous improvement.
• You’ll be a critical partner in maintaining and enhancing our security practices, with opportunities to grow deeper into the Risk and InfoSec management space (e.g., AWS, DevOps, and security infrastructure) over time
• You’ll report to our Manager of InfoSec and collaborate cross-functionally with IT, Engineering, Legal, People Ops, and other teams to keep our security, privacy, and compliance programs running smoothly and effectively
• Maintaining and monitoring SOC 2 controls, tests, and evidence. Assisting with coordination of any required remediation or documentation generation
• Proactively identifying, raising, and documenting risks as part of our ongoing Risk Management program
• Performing access reviews across Zus Identity-Provider (Okta), customer environments, SaaS tools, and Google Workspace
• Performing the security review aspect of new software acquisition or purchase request within Zus
• Managing Vendor Review and Third-Party Risk Management (TPRM) workflows
• Leading the configuration, maintenance, and reporting for security awareness and anti-phishing campaigns
• Operating the master InfoSec program schedule, ensuring all annual and quarterly security activities are completed on time, documented thoroughly, and the compliance artifacts are generated and securely stored.
• Planning, coordinating, and publishing materials for scheduled activities such as postmortems, incident debriefs, and tabletop exercises
• Driving annual compliance activities, such as Disaster Recovery tests, Incident Response tests, Network reviews, Penetration tests, Risk Assessments, and Customer SSO credential rotations
• Coordinating quarterly compliance reviews in partnership with Legal and other stakeholders
• Helping prioritize and track incident postmortem follow-up actions
• Contribute to implementation work related to configuration-as-code and GitOps workflows
• Maintain hygiene (related to sensitive customer data, PHI) in shared environments (e.g., Google Drive monitoring and cleanup)