Information Security Analyst at NEPC, LLC
United States
$80.5k - $106.6k
<p><strong>Level: </strong>3-5 years of experience</p> <p><strong>Location:</strong> Flexible (East Coast preferred). Must reside in a state where we are registered.</p> <p><span style="text-decoration: underline;"><strong>Role Summary:</strong></span></p> <p><span>The Information Security Analyst is a role reporting to the Director of Information Security and focused primarily on security operations, investigations, and vulnerability follow-through, with secondary responsibility for governance and operational risk coordination. The analyst works across security tools and business processes to identify issues, investigate activity, document findings, and drive remediation with IT and other stakeholders.</span><span data-ccp-props="{}"> </span></p> <p><span>This role is responsible for monitoring and investigating alerts and vulnerabilities, coordinating response and remediation efforts, maintaining clear documentation, and supporting core security governance activities such as the risk register, committee records, and audit evidence. Success in this role requires strong judgment, disciplined procedure-following, clear communication, and the ability to work independently while collaborating across technical and non-technical teams.</span><span data-ccp-props="{}"> </span></p> <p><span style="text-decoration: underline;"><strong>Core Responsibilities:</strong></span><span data-ccp-props="{}"> </span></p> <ul> <li aria-setsize="-1" data-list-defn-props="{"335552541":1,"335559685":720,"335559991":360,"469769226":"Symbol","469769242":[8226],"469777803":"left","469777804":"","469777815":"multilevel"}" data-aria-posinset="1" data-aria-level="1"><span>Monitor, investigate, and triage alerts, events, vulnerabilities, and escalated helpdesk tickets across the security stack; Understanding potential impact and distinguishing meaningful threats from false positives or low-risk activity.</span><span data-ccp-props="{}"> </span></li> <li aria-setsize="-1" data-list-defn-props="{"335552541":1,"335559685":720,"335559991":360,"469769226":"Symbol","469769242":[8226],"469777803":"left","469777804":"","469777815":"multilevel"}" data-aria-posinset="2" data-aria-level="1"><span>Coordinate with IT, Business Analysts, process owners, and other stakeholders to drive remediation, containment, follow-up, and closure of security and operational risk issues.</span><span data-ccp-props="{}"> </span></li> <li aria-setsize="-1" data-list-defn-props="{"335552541":1,"335559685":720,"335559991":360,"469769226":"Symbol","469769242":[8226],"469777803":"left","469777804":"","469777815":"multilevel"}" data-aria-posinset="3" data-aria-level="1"><span>Document investigative steps, evidence, decisions, remediation progress, and outcomes in a clear, consistent, and repeatable manner; identify recurring issues, process gaps, and broader trends, and escalate them appropriately.</span><span data-ccp-props="{}"> </span></li> <li aria-setsize="-1" data-list-defn-props="{"335552541":1,"335559685":720,"335559991":360,"469769226":"Symbol","469769242":[8226],"469777803":"left","469777804":"","469777815":"multilevel"}" data-aria-posinset="4" data-aria-level="1"><span>Support vulnerability management activities, including scan coordination, review of findings, remediation tracking, follow-up on overdue items, and validation of progress against defined timelines.</span><span data-ccp-props="{}"> </span></li> <li aria-setsize="-1" data-list-defn-props="{"335552541":1,"335559685":720,"335559991":360,"469769226":"Symbol","469769242":[8226],"469777803":"left","469777804":"","469777815":"multilevel"}" data-aria-posinset="5" data-aria-level="1"><span>Maintain the risk register, including risk descriptions, owners, mitigation plans, status updates, and supporting records, and work alongside Business Analysts and process owners to identify and document operational risks, control gaps, and dependencies revealed through incidents, investigations, or project work.</span><span data-ccp-props="{}"> </span></li> <li aria-setsize="-1" data-list-defn-props="{"335552541":1,"335559685":720,"335559991":360,"469769226":"Symbol","469769242":[8226],"469777803":"left","469777804":"","469777815":"multilevel"}" data-aria-posinset="6" data-aria-level="1"><span>Assist with Operational Risk Council activities by preparing materials, tracking action items, and maintaining meeting records, and organize documentation and evidence needed for audits, regulatory requests, and internal reviews.</span><span data-ccp-props="{}"> </span></li> <li aria-setsize="-1" data-list-defn-props="{"335552541":1,"335559685":720,"335559991":360,"469769226":"Symbol","469769242":[8226],"469777803":"left","469777804":"","469777815":"multilevel"}" data-aria-posinset="7" data-aria-level="1"><span>Partner with the Compliance team to support security and privacy requirements related to client contractual obligations, Regulation S-P, and emerging technology use cases.</span><span data-ccp-props="{}"> </span></li> <li aria-setsize="-1" data-list-defn-props="{"335552541":1,"335559685":720,"335559991":360,"469769226":"Symbol","469769242":[8226],"469777803":"left","469777804":"","469777815":"multilevel"}" data-aria-posinset="8" data-aria-level="1"><span>Support security procedures, policy updates, and awareness efforts by helping keep documentation current and identifying useful communication or training opportunities based on trends and observed issues.</span><span data-ccp-props="{}"> </span></li> </ul> <p><span style="text-decoration: underline;"><strong>Required and Preferred Qualifications:</strong></span><span data-ccp-props="{}"> </span></p> <p><strong><span>Experience and Background</span></strong><span data-ccp-props="{}"> </span><span data-ccp-props="{}"> </span></p> <ul> <li aria-setsize="-1" data-list-defn-props="{"335552541":1,"335559685":720,"335559991":360,"469769226":"Symbol","469769242":[8226],"469777803":"left","469777804":"","469777815":"multilevel"}" data-aria-posinset="1" data-aria-level="1"><span>Requires 3–5 years of working experience in information security, IT Infrastructure, systems administration, networking, and/or technical support; additional audit, compliance, or risk-related experience is helpful.</span><span data-ccp-props="{}"> </span></li> <li aria-setsize="-1" data-list-defn-props="{"335552541":1,"335559685":720,"335559991":360,"469769226":"Symbol","469769242":[8226],"469777803":"left","469777804":"","469777815":"multilevel"}" data-aria-posinset="2" data-aria-level="1"><span>Relevant certifications may include Security+, CySA+, ISC2 entry-level certifications, GSEC, or similar information security, audit, or risk-related certifications.</span><span data-ccp-props="{}"> </span></li> <li aria-setsize="-1" data-list-defn-props="{"335552541":1,"335559685":720,"335559991":360,"469769226":"Symbol","469769242":[8226],"469777803":"left","469777804":"","469777815":"multilevel"}" data-aria-posinset="3" data-aria-level="1"><span>Associate’s degree preferred but not required.</span><span data-ccp-props="{}"> </span></li> </ul> <p><strong>Skills and Knowledge</strong><span data-ccp-props="{}"> </span><span data-ccp-props="{}"> </span></p> <ul> <li aria-setsize="-1" data-list-defn-props="{"335552541":1,"335559685":720,"335559991":360,"469769226":"Symbol","469769242":[8226],"469777803":"left","469777804":"","469777815":"multilevel"}" data-aria-posinset="1" data-aria-level="1"><span>Working knowledge of and experience with security operations activities such as alert triage, vulnerability tracking, investigation workflows, escalation, and documentation.</span><span data-ccp-props="{}"> </span></li> <li aria-setsize="-1" data-list-defn-props="{"335552541":1,"335559685":720,"335559991":360,"469769226":"Symbol","469769242":[8226],"469777803":"left","469777804":"","469777815":"multilevel"}" data-aria-posinset="2" data-aria-level="1"><span>Proficiency using security and IT tools such as endpoint protection, vulnerability management platforms, SIEM, ticketing systems, dashboards, and related technologies.</span><span data-ccp-props="{}"> </span></li> <li aria-setsize="-1" data-list-defn-props="{"335552541":1,"335559685":720,"335559991":360,"469769226":"Symbol","469769242":[8226],"469777803":"left","469777804":"","469777815":"multilevel"}" data-aria-posinset="3" data-aria-level="1"><span>Strong written and verbal communication skills across teams with different technical and operational backgrounds.</span><span data-ccp-props="{}"> </span></li> <li aria-setsize="-1" data-list-defn-props="{"335552541":1,"335559685":720,"335559991":360,"469769226":"Symbol","469769242":[8226],"469777803":"left","469777804":"","469777815":"multilevel"}" data-aria-posinset="4" data-aria-level="1"><span>Ability to follow procedures carefully, improve documentation where needed, and manage work with minimal supervision.</span><span data-ccp-props="{}"> </span></li> <li aria-setsize="-1" data-list-defn-props="{"335552541":1,"335559685":720,"335559991":360,"469769226":"Symbol","469769242":[8226],"469777803":"left","469777804":"","469777815":"multilevel"}" data-aria-posinset="5" data-aria-level="1"><span>Sound judgment, attention to detail, and the ability to prioritize effectively when handling multiple issues.</span><span data-ccp-props="{}"> </span></li> <li aria-setsize="-1" data-list-defn-props="{"335552541":1,"335559685":720,"335559991":360,"469769226":"Symbol","469769242":[8226],"469777803":"left","469777804":"","469777815":"multilevel"}" data-aria-posinset="6" data-aria-level="1"><span>Familiarity with CIS Controls, NIST, CISA publications, and related standards is helpful.</span><span data-ccp-props="{}"> </span></li> </ul> <p><span style="text-decoration: underline;"><strong>Compensation:</strong></span><span data-ccp-props="{}"> </span></p> <p>The base salary for this role is $80,500 - $106,600 per year with an additional annual performance bonus. Individual compensation is based on a variety of factors, including experience, education, certifications, location, responsibilities of the role, internal equity and alignment with market data. <span data-ccp-props="{}"> </span></p> <p><span style="text-decoration: underline;"><strong>Company Background:</strong></span><span data-ccp-props="{}"> </span></p> <p>NEPC, LLC is a full-service investment consulting firm based in Boston, Massachusetts. We were founded in 1986 and now have approximately 375 employees and over 400 clients. We help governments, institutions, families, and individuals preserve and grow their capital across different asset classes and market cycles. We provide a variety of consulting services such as asset allocation, performance measurement, policy formulation, investment manager research, and discretionary portfolio management. Our clients include defined benefit, defined contribution, endowments, foundations, trusts, public, corporate, Taft-Hartley, health & welfare, high net worth, insurance, and private plans. <span data-ccp-props="{}"> </span></p> <p>Culture is important to us here at NEPC – our values include putting clients first, doing the right thing, bringing your whole self to work, building trust, embracing change, and having a “we before me” approach in our work. Advancing diversity and inclusion within our firm and industry is also a core initiative at NEPC. We are a strong advocate of promotion from within, so excellent potential exists for professional growth. We’re a fun (but demanding) company with excellent working conditions, a very supportive, team-oriented environment, and a full benefits program to support your life and well-being. We offer a competitive salary and bonuses (when applicable).<em> </em> <span data-ccp-props="{}"> </span></p> <p><em>NEPC is an Affirmative Action/Equal Opportunity Employer (July 2026)</em><span data-ccp-props="{}"> </span></p>
Apply Now
