IT & Security Operations Analyst

Job Description

Job Description

Description:

  About LCvista

LCvista is a dynamic and innovative company dedicated to transforming how firms navigate their learning and compliance landscapes. With a mission to bring clarity, understanding, and efficiency to these critical processes, we empower organizations to achieve their goals with confidence and ease. Guided by our core values of Integrity, Continuous Improvement, and Collaboration, we foster a culture where creativity and teamwork drive impactful solutions. At LCvista, we don't just provide a service - we create a partnership that fuels growth and success for our clients and our team. Join us to help shape the future of learning and compliance!

The Opportunity

Our customers trust us with their learning and compliance data, and we take that responsibility seriously. As we grow, the volume of security and compliance work has grown with us, and we're investing in a dedicated role to support it. You'll serve as the first point of contact for day-to-day IT and security program operations, owning requests through resolution and escalating to the CTO, vCISO, MSP, or other leaders when a risk, exception, or business decision requires their involvement.  In this hands-on role, you'll keep our SOC 2 program running, handle customer security reviews, manage the employee and vendor lifecycle, and be a go-to technical resource for the tools our teams use every day.

You'll work closely with our CTO, vCISO, and our Managed Service Provider (MSP), which administers our Microsoft 365 environment, laptop endpoint management, and tactical IT support. You'll make sure processes are followed, evidence is ready, vendors are vetted, and our roughly 100 employees and contractors have secure, working technology. This is a great opportunity for someone with a solid technical foundation who wants to grow their security and compliance expertise with strong support behind them.

Key Responsibilities

You will run the daily operations of LCvista's security and compliance program, manage the technology lifecycle for our people and vendors, and support teams across the company with their tools and technical needs. Your time will be focused in the following areas:

SOC 2 & Compliance Operations

• Manage the day-to-day operations of our SOC 2 Type II program, including evidence collection, control monitoring, and auditor coordination.

• Keep controls passing continuously throughout the year by monitoring control health in our compliance tooling and working with control owners to fix gaps quickly.

• Coordinate the annual review and update of our security policies and procedures, in partnership with the vCISO.

• Run periodic user access reviews across critical systems, including AWS, M365, and key SaaS applications, and keep evidence of completion.

Security Program Operations

• Operate and document LCvista's security program in our compliance platform (ControlMap), keeping policies, controls, and evidence current.

• Run the employee security awareness program: onboarding training, annual training, phishing simulations, and tracking completion across employees and contractors.

• Coordinate developer security training with Engineering.

• Coordinate annual third-party penetration tests, including vendor scheduling and logistics, and track findings with Engineering through remediation and retest.

• Track vulnerability prioritization and remediation with Engineering. 

• Support incident response activities and take part in tabletop exercises under the direction of the vCISO.

• Stay current on security news, threats, and vulnerabilities, and flag relevant risks to the CTO and vCISO.

Customer Trust & Security Reviews

• Manage the response process for customer and prospect security questionnaires, keeping answers accurate, consistent, and timely.

• Build and maintain a reusable library of approved security answers and supporting documentation so response time drops as volume grows.

• Support Sales, Customer Success, and Legal in reviewing security and data protection terms in customer contracts, flagging commitments that go beyond our current controls.

Vendor Management

• Partner with the CFOO and CTO to run security reviews and approvals for new vendors.

• Review vendors' security documentation, such as SOC 2 reports, questionnaires, and DPAs, and escalate risks to the CFOO and CTO.

• Maintain an inventory of vendors and SaaS applications, including owners, data access, contract renewals, and periodic re-assessments.

• Help teams understand and follow vendor management policies so new tools are adopted quickly and safely.

Employee Lifecycle & IT Operations

• Serve as LCvista's day-to-day point of contact for our MSP, tracking SLAs and making sure their work meets our security standards and SOC 2 requirements.

• Manage onboarding, role changes, and offboarding for employees and contractors with the MSP and People Operations, including timely access provisioning and revocation and auditable records of every change.

• Own the laptop lifecycle: procurement, inventory, shipping and setup with the MSP, recovery from departing employees, and secure end-of-life disposal with certificates of data destruction.

• Work with the MSP and vCIO to make sure M365 and endpoint configurations meet our security standards, including MFA, encryption, patching, and EDR coverage.

• Act as a technical resource for back-office tools, including M365, collaboration, HR, finance, and sales platforms. Help with configuration, user administration, and troubleshooting, and escalate to the MSP or vendors when needed.

• Document common procedures and build self-service guides so recurring requests take less effort over time.

Here's what we're looking for

• 3+ years of experience in IT operations, IT security, or compliance, ideally at a SaaS or technology company.

• Hands-on experience supporting a SOC 2, ISO 27001, or similar audit, including evidence collection and control monitoring.

• Experience completing customer security questionnaires or supporting security reviews.

• A solid general technical background, including working knowledge of Microsoft 365 and Entra ID administration (users, groups, MFA, licensing).

• Experience managing IT asset or laptop lifecycles, from procurement through secure disposal.

• Comfort administering and troubleshooting a range of SaaS business applications.

• Familiarity with security fundamentals and frameworks, such as NIST CSF, CIS Controls, and OWASP.

• Strong organizational skills and attention to detail, especially for tracking inventories, evidence, and vendor records.

• Clear written and verbal communication skills, with the ability to explain technical and security topics to non-technical colleagues.

• A service-oriented mindset and the ability to manage competing priorities across teams.

• Must be currently authorized to work in the United States for any employer.

Preferred

• Experience with compliance automation platforms, such as Vanta, Drata, or ControlMap.

• Experience with security awareness platforms, such as KnowBe4.

• Experience running vendor risk management or third-party security review processes.

• Familiarity with AWS security fundamentals, such as IAM, logging, and encryption.

• Relevant certifications, such as CompTIA Security+, Network+, or Microsoft 365 Fundamentals/Administrator, or progress toward one.

• Experience with questionnaire automation or trust center tools.

• Basic scripting or automation skills (e.g., PowerShell, Python, or workflow tools like n8n or Power Automate).

• Experience with multi-tenant SaaS, compliance platforms, or edtech.

Don't feel like you have all the qualifications?

The description above outlines our current vision for the role, but you don't need to meet every qualification to be considered. You may also have valuable skills or experiences we haven't included. If you think this could be a good fit, we encourage you to apply so we can learn more about you.

Support for Your Success

• Health, Dental, and Vision Insurance (100% paid premiums for employees, 80% paid for dependents with a buy-up plan option)

• HRA, FSA, HSA offerings

• Unlimited PTO & Sick/Wellness Hours

• Paid parental leave, paid medical leave

• 12 paid holidays + 2 flexible holidays

• 401k, Roth options

• Anniversary awards

• Laptop + keyboard with an annual work-from-home stipend to purchase equipment needed for home offices

LCvista is committed to fostering a diverse and inclusive workplace and is an equal opportunity employer. We evaluate all qualified applicants without regard to race, color, religion, gender, gender identity or expression, sexual orientation, national origin, genetics, disability, age, veteran status, or any other protected characteristic. We also comply with all applicable fair employment practices regarding citizenship and immigration status.

This position will remain open until it is filled.