Position: IT Security Analyst II

Location: Grafton, Wisconsin

Remote Type: Hybrid

Reports To: Senior Manager, Cybersecurity Compliance, Data Privacy & AI Governance

We areseekinga motivated and detail-oriented IT Security Analyst II to support the organization’sAIgovernance,IT compliance andsecurity, and third-party risk management programs. This mid-level role will help translate security, privacy, regulatory, contractual, andAI governancerequirements into practical controlsincludingrisk assessments,evidencecollectionand remediation plans. The analyst will partnerwith ITinfrastructure, PMO, Legal, Privacy, Procurement, business stakeholders, and third-party vendors to strengthen the organization’s security posture, improve audit readiness, and support responsible and secure adoption of AI-enabled technologies.

Key Responsibilities

IT Security Complianceand Governance

• Support day-to-dayoperationof the IT security compliance program, including control documentation, evidence collection, audit readiness, and remediation tracking.

• Assistwith control mappings and compliance activities across applicable frameworks, standards, laws, and contractual requirements such as NIST,CMMC, SOC 2, data protection requirements, and internal policies.

• Partner with security, IT, privacy, legal, and business stakeholders to interpret compliance requirements and translate them into actionable control activities.

• Maintain compliance records, control narratives, risk registers, policies, procedures, and supporting documentation.

• Track compliance gaps, audit findings, exceptions, risks, and remediation plans to ensuretimelyclosure andappropriate escalation.

AI Security and Responsible AI Governance

• Research and keep apprised for latest updatesinAI trends and AI Security.

• Support security and governance reviews for AI-enabled tools, platforms, models, and use cases to help ensure responsible, compliant, and secure adoption.

• AssistinmaintainingAI security documentation, including inventories, risk assessments, control evidence, usage guidelines, data handling requirements, andapprovalrecords.

• Evaluate AI-related risks such as sensitive data exposure, unauthorized use, third-party AI dependencies, model access controls, prompt and output handling, and operational misuse.

• Collaborate with security, privacy, legal, data, product, and technology teams to assess AI use cases against internal policies and emerging AI governance expectations.

• Monitor AI security and governance findings and coordinate remediation activities with accountable owners.

Third-Party Risk Management

• Support the third-party risk management lifecycle, including vendor intake, inherent risk reviews, due diligence questionnaires, security assessments, reassessments, and offboarding activities.

• Review supplier security documentation, certifications, audit reports, data protection materials, and responses to security questionnaires toidentifyrisks and control gaps.

• Assist with vendor risk scoring, issue tracking, exception documentation, and remediation follow-up to ensure third-party risks are appropriately managed.

• Partner with Procurement, Legal, Privacy, Security, IT, and business owners to support contract reviews, data protection requirements, and security obligations.

• Pay special attention to third-party AI tools and services, including reviewing AI-related data handling, access controls,sub processors, model usage, and compliance requirements.

Risk Reporting, Process Improvement, and Stakeholder Support

• Prepare clear,accuratereports, dashboards, and summaries that communicate compliance status, AI security risks, third-party risk posture, remediation progress, and key trends.

• Support internal and external audits by coordinating evidence requests,validatingcontrol implementation, and tracking follow-up actions.

• Contribute to continuous improvement of GRC processes, security workflows, vendor review procedures, AI governance practices, and reporting standards.

• Assistwith security awareness, policy communications, and guidance for business teams related to compliance, AI security, and third-party risk expectations.

• Maintain awareness of cybersecurity, compliance, AI governance, privacy, and third-party risk trends and recommend practical improvements to the program.

Qualifications

• Associate's Degree (or equivalent experience) with 3-4 years of relevant experience in cybersecurity, IT audit, IT security compliance, governance, risk management, third-party risk management, privacy, ora relatedfunction required.

• Bachelor's Degree preferred.

• Working knowledge of cybersecurity governance, compliance, and risk management concepts, including security control frameworks and audit readiness practices.

• Familiarity with one or more frameworks or standards such as NIST, ISO 27001, SOC 2, CIS Controls, PCI DSS, or similar control environments.NIST 800-171 or CMMC knowledge is a plus.

• Exposure to AI security, responsible AI governance, data protection, model or tool risk assessments, or emerging AI regulatory requirements preferred.

• Experience supporting third-party risk assessments, vendor security reviews, security questionnaires, contract security reviews, or supplier remediation tracking preferred.

• Ability to collect, organize,validate, and document audit evidence and compliance artifacts with strong attention to detail.

• Strong analytical, problem-solving, written communication, and stakeholder-management skills.

• Ability to work collaboratively across technical and non-technical teams and communicate risk in clear, business-oriented language.

• Relevant certifications such as Security+,CySA+, CISA, CRISC, CGRC, CISSP Associate, ISO 27001, or other security, audit, risk, or compliance certifications preferred.

NOT OFFERING SPONSORSHIP:

Candidates must be eligible to work in the United States without requiring company sponsorship to obtain or keep U.S. work authorization.

#LI-Hybrid #LI-AB-1