IT Cybersecurity & Compliance Administrator

Job Description

Job Description:\n\nWho We Are\nNorlee Group, Inc. is a multi-trade building systems organization delivering integrated electrical, mechanical, and technology solutions across commercial, industrial, institutional, and specialty markets. As part of our continued growth under the One Norlee platform, we are strengthening our cybersecurity, information security, and compliance capabilities to protect our people, systems, data, and business operations.Position Summary\nThe IT Cybersecurity & Compliance Administrator is responsible for supporting and administering Norlee Group's cybersecurity, information security, and compliance program while providing technical support for core IT security operations.\nThis position serves as a key operational owner for Tier 1 cybersecurity and compliance activities, including security control administration, compliance evidence collection, access reviews, vulnerability tracking, security monitoring, policy enforcement, audit preparation, risk management, and security awareness.\nThe role works closely with IT, Infrastructure Engineering, Service Desk, Human Resources, Finance, business leadership, vendors, and external auditors to ensure security controls are consistently implemented, documented, monitored, and maintained.\nThe successful candidate will be highly detail-oriented and comfortable working within structured compliance programs where documentation, evidence, deadlines, and control execution are critical. This position is expected to identify gaps, escalate risks, maintain accurate records, and ensure cybersecurity and compliance requirements are incorporated into day-to-day IT operations.Essential Duties and ResponsibilitiesCybersecurity & Security Operations\n\n Administer and continuously improve foundational cybersecurity controls, including endpoint protection, email security, MFA, identity and access management, privileged access, network security, system hardening, encryption, and cloud security configurations.\n Monitor security alerts, notifications, and dashboards and perform initial investigation, triage, documentation, and escalation of suspected security incidents.\n Support incident response activities by collecting relevant information, documenting events and actions taken, maintaining incident records, and escalating incidents according to established procedures.\n Maintain and monitor security configurations across endpoints, servers, Microsoft 365, Azure/AWS environments, network infrastructure, and other critical technology platforms.\n Assist with vulnerability management activities, including vulnerability scanning, remediation tracking, risk prioritization, exception documentation, and verification of corrective actions.\n Support patch management and security remediation efforts by identifying overdue or non-compliant systems and coordinating remediation with appropriate IT personnel.\n Assist with secure configuration and hardening standards for Windows, Linux, endpoints, network devices, cloud resources, and business applications.\n Support identity and access management processes, including account provisioning, deprovisioning, access changes, privileged access reviews, and periodic user access certifications.\n Investigate and document security-related service desk tickets and escalate issues requiring advanced technical or incident-response support.\n Support backup, disaster recovery, business continuity, and incident response testing from a cybersecurity and control-validation perspective.\nCompliance & Governance\n\n Serve as a primary operational resource for maintaining Tier 1 cybersecurity and compliance controls and ensuring required activities are completed on schedule.\n Support compliance programs and control frameworks such as SOC 2 Type 2, ISO 27001, CMMC, NIST, and other applicable security standards.\n Maintain compliance control documentation, including control descriptions, procedures, ownership assignments, testing requirements, evidence requirements, and remediation plans.\n Collect, organize, validate, and maintain audit evidence in accordance with established compliance schedules and requirements.\n Maintain evidence repositories and ensure artifacts are complete, current, appropriately dated, and traceable to the applicable security control.\n Perform recurring compliance activities such as access reviews, security awareness tracking, vulnerability reviews, policy acknowledgments, endpoint compliance checks, backup verification, and security configuration reviews.\n Maintain compliance calendars and control schedules to ensure recurring activities are completed within required timeframes.\n Track control deficiencies, audit findings, exceptions, corrective actions, and remediation activities through completion.\n Assist with internal control testing and coordinate with control owners to identify gaps and implement corrective actions.\n Support preparation for internal and external audits by organizing evidence, responding to auditor requests, coordinating meetings, and tracking outstanding items.\n Maintain documentation demonstrating the operating effectiveness of cybersecurity and compliance controls.\n Identify control gaps and potential areas of non-compliance and escalate material risks to appropriate leadership.\n Assist in maintaining the organization's information security risk register and tracking identified risks through mitigation, acceptance, transfer, or remediation.\n Support development and maintenance of policies, standards, procedures, and guidelines required by the organization's security and compliance program.\nRisk Management & Third-Party Security\n\n Support third-party/vendor security assessments by reviewing security questionnaires, SOC reports, certifications, policies, and other security documentation.\n Maintain vendor security records and track outstanding security requirements, exceptions, and remediation activities.\n Assist in evaluating technology and service providers against organizational security and compliance requirements.\n Support periodic reviews of critical vendors and service providers based on established risk criteria.\n Escalate material vendor security concerns and assist in documenting risk acceptance or remediation decisions.\nSecurity Awareness & Training\n\n Administer the organization's security awareness and training program, including onboarding training, recurring security training, policy acknowledgments, and phishing simulations.\n Track employee participation and completion and report outstanding requirements to appropriate management.\n Assist in developing security awareness communications covering phishing, password security, MFA, social engineering, acceptable use, data protection, and other relevant security topics.\n Promote a security-conscious culture by communicating cybersecurity requirements in a clear and practical manner.\nIT Administration & Security Support\n\n Provide Tier 1/Tier 2 technical support for security-related systems and controls, including endpoint security, identity platforms, MFA, email security, access controls, and security monitoring tools.\n Assist with user onboarding and offboarding processes to ensure accounts, devices, applications, permissions, and access rights are provisioned and removed according to established security procedures.\n Collaborate with Infrastructure Engineering and Service Desk teams to implement and maintain secure technology configurations.\n Assist with administration of Microsoft 365, Active Directory/Entra ID, endpoint management, security platforms, and other enterprise IT systems.\n Maintain accurate IT and security documentation, including system inventories, control documentation, procedures, security configurations, and operational runbooks.\n Contribute to the organization's asset inventory and assist with identifying systems, applications, endpoints, and other technology assets that fall within compliance scope.\n Participate in technology projects to ensure cybersecurity and compliance requirements are addressed during planning, implementation, and deployment.\n Perform other duties as assigned.\nKey Responsibilities / Success Measures\nSuccess in this position will be demonstrated through:\n\n Consistent completion of assigned cybersecurity and compliance controls.\n Accurate, complete, and audit-ready compliance evidence.\n Timely identification and escalation of security risks and control deficiencies.\n Effective tracking and closure of vulnerabilities, audit findings, and remediation activities.\n Accurate and timely completion of user access reviews and security-related administrative processes.\n Maintenance of current security policies, procedures, standards, and supporting documentation.\n Strong audit readiness with minimal outstanding evidence requests or overdue compliance activities.\n Effective collaboration between IT, business stakeholders, vendors, and auditors.\n Continuous improvement of the organization's cybersecurity and compliance posture.\nCompetencies\nTech Savvy: Maintains working knowledge of cybersecurity technologies, enterprise IT systems, identity management, endpoint security, cloud platforms, vulnerability management, and security monitoring. Demonstrates an ability to learn and administer new security tools and technologies.\nAttention to Detail: Demonstrates a high level of accuracy when managing compliance evidence, security records, access reviews, audit documentation, policies, and control activities. Recognizes discrepancies and follows through to resolution.\nEnsures Accountability: Takes ownership of assigned security and compliance controls, recurring activities, remediation tasks, and audit requests. Consistently meets deadlines and maintains accurate documentation.\nManages Complexity: Evaluates security alerts, compliance requirements, vulnerabilities, control deficiencies, and technical issues. Understands how individual security activities contribute to broader organizational risk.\nRisk Awareness: Recognizes cybersecurity risks and control weaknesses and appropriately escalates issues based on potential business impact.\nCollaborates: Works effectively with IT, Infrastructure Engineering, Service Desk, Human Resources, Finance, business leaders, vendors, and auditors to implement security controls and meet compliance requirements.\nCommunicates Effectively: Clearly communicates cybersecurity requirements, compliance obligations, risks, deficiencies, and remediation activities to both technical and non-technical audiences.Qualifications\nTo perform this job successfully, an individual must be able to perform each essential duty satisfactorily. The requirements listed below represent the knowledge, skills, and abilities required. Reasonable accommodations may be made to enable individuals with disabilities to perform the essential functions.Education and/or Experience\nAssociate's or Bachelor's degree in Cybersecurity, Information Technology, Computer Science, Information Systems, or a related field, or equivalent professional experience.\nA minimum of three (3) years of progressive IT, cybersecurity, information security, or compliance experience is preferred, with demonstrated experience supporting cybersecurity controls and compliance programs.\nCandidates should have hands-on experience with several of the following:\n\n Cybersecurity and information security controls\n SOC 2, ISO 27001, CMMC, NIST, or similar compliance frameworks\n Compliance evidence collection and audit preparation\n Security policies, procedures, standards, and control documentation\n Identity and access management\n Microsoft 365 and Entra ID/Active Directory\n Endpoint detection and response (EDR) or endpoint protection platforms\n Security information and event management (SIEM) platforms\n Vulnerability management and remediation tracking\n MFA and conditional access\n Security awareness and phishing simulation platforms\n Microsoft Azure or AWS security controls\n Windows and Linux security administration\n Network security concepts, including firewalls, VPNs, segmentation, and secure configurations\n Incident identification, triage, documentation, and escalation\n Risk assessments and remediation tracking\n Vendor/third-party security assessments\n\nExperience working in an organization subject to formal customer, regulatory, contractual, or third-party cybersecurity requirements is highly desirable.\nExperience supporting construction, engineering, manufacturing, field services, or other distributed/operational environments is preferred.\nProfessional certifications such as CompTIA Security+, CySA+, SSCP, CISA, CISM, CISSP, ISO 27001, CMMC, or relevant cloud/security certifications are beneficial.Language/Interpersonal/Leadership Skills\nThe successful candidate must possess strong written and verbal communication skills and be able to clearly communicate cybersecurity, compliance, and technical requirements to both technical and non-technical audiences.\nStrong organizational and documentation skills are essential. The candidate must be comfortable managing multiple recurring compliance activities, deadlines, evidence requests, remediation items, and security-related tasks simultaneously.\nThe individual must demonstrate strong attention to detail and the ability to identify inconsistencies, missing documentation, control gaps, and potential security risks.\nThe candidate should be comfortable working with auditors, vendors, IT personnel, and business stakeholders and must be able to appropriately escalate issues when established security or compliance requirements are not being met.\nA continuous learning mindset is essential to remain current with evolving cybersecurity threats, technologies, compliance requirements, and industry best practices.Mathematical Skills\nBasic mathematical skills, including the ability to perform addition, subtraction, multiplication, and division with whole numbers, fractions, and decimals, are necessary for the role.Computer Skills\nStrong proficiency with enterprise IT and cybersecurity systems is required. Experience should include Microsoft 365, Windows, Active Directory/Entra ID, endpoint security platforms, MFA and identity management solutions, vulnerability management tools, security awareness platforms, SIEM or security monitoring tools, and cloud administration/security environments such as Azure or AWS.\nExperience with GRC, compliance management, ticketing, documentation, or audit evidence management platforms is highly desirable.Physical Demands\nThe physical demands described here are representative of those required to successfully perform the essential functions of this job. Reasonable accommodations may be made to enable individuals with disabilities to perform the essential functions.\nThe employee is frequently required to sit, stand, walk, and operate computer equipment. Occasional lifting of up to 15 pounds may be required. Specific vision abilities include close vision, distance vision, peripheral vision, and depth percep