Information Security Analyst

Level: 3-5+ years of related experience

Location: Flexible (East Coast preferred). Must reside in a state where we are registered.

Role Summary:

The Information Security Analyst is a role reporting to the Director of Information Security and focused primarily on security operations, investigations, and vulnerability follow-through, with secondary responsibility for governance and operational risk coordination. The analyst works across security tools and business processes to identify issues, investigate activity, document findings, and drive remediation with IT and other stakeholders.

This role is responsible for monitoring and investigating alerts and vulnerabilities, coordinating response and remediation efforts, maintaining clear documentation, and supporting core security governance activities such as the risk register, committee records, and audit evidence. Success in this role requires strong judgment, disciplined procedure-following, clear communication, and the ability to work independently while collaborating across technical and non-technical teams.

Core Responsibilities:

Monitor, investigate, and triage alerts, events, vulnerabilities, and escalated helpdesk tickets across the security stack; Understanding potential impact and distinguishing meaningful threats from false positives or low-risk activity. Coordinate with IT, Business Analysts, process owners, and other stakeholders to drive remediation, containment, follow-up, and closure of security and operational risk issues. Document investigative steps, evidence, decisions, remediation progress, and outcomes in a clear, consistent, and repeatable manner; identify recurring issues, process gaps, and broader trends, and escalate them appropriately. Support vulnerability management activities, including scan coordination, review of findings, remediation tracking, follow-up on overdue items, and validation of progress against defined timelines. Maintain the risk register, including risk descriptions, owners, mitigation plans, status updates, and supporting records, and work alongside Business Analysts and process owners to identify and document operational risks, control gaps, and dependencies revealed through incidents, investigations, or project work. Assist with Operational Risk Council activities by preparing materials, tracking action items, and maintaining meeting records, and organize documentation and evidence needed for audits, regulatory requests, and internal reviews. Partner with the Compliance team to support security and privacy requirements related to client contractual obligations, Regulation S-P, and emerging technology use cases. Support security procedures, policy updates, and awareness efforts by helping keep documentation current and identifying useful communication or training opportunities based on trends and observed issues.

Required and Preferred Qualifications:

Experience and Background

Requires 3–5 years of working experience in information security, IT Infrastructure, systems administration, networking, and/or technical support; additional audit, compliance, or risk-related experience is helpful. Relevant certifications may include Security+, CySA+, ISC2 entry-level certifications, GSEC, or similar information security, audit, or risk-related certifications. Associate’s degree preferred but not required.

Skills and Knowledge

Working knowledge of and experience with security operations activities such as alert triage, vulnerability tracking, investigation workflows, escalation, and documentation. Proficiency using security and IT tools such as endpoint protection, vulnerability management platforms, SIEM, ticketing systems, dashboards, and related technologies. Strong written and verbal communication skills across teams with different technical and operational backgrounds. Ability to follow procedures carefully, improve documentation where needed, and manage work with minimal supervision. Sound judgment, attention to detail, and the ability to prioritize effectively when handling multiple issues. Familiarity with CIS Controls, NIST, CISA publications, and related standards is helpful.

Compensation:

The base salary for this role is $80,500 - $107,500 per year with an additional annual performance bonus. Individual compensation is based on a variety of factors, including experience, education, certifications, location, responsibilities of the role, internal equity and alignment with market data.

Company Background:

NEPC, LLC is a full-service investment consulting firm based in Boston, Massachusetts. We were founded in 1986 and now have approximately 375 employees and over 400 clients. We help governments, institutions, families, and individuals preserve and grow their capital across different asset classes and market cycles. We provide a variety of consulting services such as asset allocation, performance measurement, policy formulation, investment manager research, and discretionary portfolio management. Our clients include defined benefit, defined contribution, endowments, foundations, trusts, public, corporate, Taft-Hartley, health & welfare, high net worth, insurance, and private plans.

Culture is important to us here at NEPC – our values include putting clients first, doing the right thing, bringing your whole self to work, building trust, embracing change, and having a “we before me” approach in our work. Advancing diversity and inclusion within our firm and industry is also a core initiative at NEPC. We are a strong advocate of promotion from within, so excellent potential exists for professional growth. We’re a fun (but demanding) company with excellent working conditions, a very supportive, team-oriented environment, and a full benefits program to support your life and well-being. We offer a competitive salary and bonuses (when applicable).

NEPC is an Affirmative Action/Equal Opportunity Employer (July 2026)