Role Description - Analyse und Bewertung von Sicherheitsrisiken in IT-Systemen, Anwendungen und Geschäftsprozesse - Durchführung von Security Assessments und Risikoanalysen - Unterstützung bei der Entwicklung, Implementierung und Weiterentwicklung von Sicherheitsrichtlinien und -standard - Bearbeitung und Eskalation sicherheitsrelevanter Ereignisse sowie Koordination geeigneter Gegenmaßnahmen - Mitarbeit bei der Umsetzung regulatorischer und normativer Anforderungen (z. B. ISO 27001, NIS2 oder BSI-Grundschutz) Qualifications - Erste Berufserfahrung im Bereich IT-Sicherheit, Cyber Security oder Security Operations von Vorteil - Grundlegende Kenntnisse in den Bereichen Netzwerke, Betriebssysteme, Cloud-Technologien und IT-Infrastrukturen - Erfahrung mit Security-Tools wie SIEM-, EDR-, Vulnerability-Management- oder Monitoring-Lösungen wünschenswert - Verständnis gängiger Angriffsvektoren, Bedrohungen und Sicherheitsframeworks Benefits - Spannende Security-Projekte mit hoher technischer Tiefe - Flexible Arbeitsmodelle und Remote-Möglichkeiten - Attraktives Gehaltspaket - Individuelle Weiterbildungs- und Zertifizierungsmöglichkeiten - Moderne Technologien und ein professionelles Security-Umfeld - über 30 Tage Urlaub - Firmenwagen-Option

• Monitor, assess and respond to cyber security incidents across enterprise environments • Lead incident investigations, root cause analysis and remediation activities • Develop and improve incident response plans, procedures and playbooks • Assess and manage technical vulnerabilities and security risks • Collaborate with SOCs, CSIRTs and business stakeholders on incident management and reporting

• plan, implement, upgrade, or monitor security measures for the protection of computer networks and information • specialize in endpoint security, vulnerability management, and application security • ensure that appropriate security controls are in place and safeguard digital files and vital electronic infrastructure • respond to computer security incidents and malware • Windows endpoint administration: Windows patches, 3rd Party Patches, Firewall, Vulnerability management • Manage Active Directory / Group Policy infrastructure • Mobile device management: Encryption, Multi-Factor authentication • Provide computer security consulting support for the university • Monitor security logs on all systems and address any incidents or anomalies recorded • Document computer security and emergency measures, policies, procedures, and testing protocols • Assure end-point protection software is kept current in accordance with departmental policy • Analysis of applications/software/policies in enterprise environment and the effects of workflows to the end-user • Ability to use powershell to automate security processes, parse security logs, and secure the environment • Confer with users to discuss issues such as computer data access needs, security violations, and programming changes • Coordinate implementation of computer system plan with establishment personnel and outside vendors • Monitor use of data files and regulate access to safeguard information in computer files • Desktop architecture • Microsoft Server and Active Directory administration • Group policy management • Building and deploying secure golden OS images

Role Description A fast-growing healthcare services company is undergoing its first SOC 2 audit and building its information security program from the ground up. The organization operates in a HIPAA-compliant, high-trust environment and is now taking on enterprise clients who require formal compliance credentials. We are placing one Security Analyst / Compliance Lead as a dedicated, embedded resource. This person will function as an extension of the internal team — owning day-to-day security operations and SOC 2 evidence collection. This is a hybrid role, not a senior architect or vCISO seat, and it does not involve facing the auditor directly. What You Will Do - Upload and manage security policies within a leading compliance automation platform - Gather, organize, and upload evidence for SOC 2 controls across the defined audit scope - Map evidence to applicable Trust Service Criteria; identify and flag gaps - Support remediation efforts and compensating controls as audit findings surface - Monitor and triage EDR alerts; perform initial investigations on security incidents - Execute incident response procedures in accordance with the client's IR plan - Handle ad hoc security and compliance tasks as directed by client leadership - Support the team in establishing repeatable security processes as the program matures Qualifications - Hands-on experience with SOC 2 compliance — familiarity with Trust Service Criteria, evidence collection, and control mapping - Proficiency with Vanta or a comparable GRC / compliance automation platform - Working knowledge of CrowdStrike or comparable EDR platforms for alert triage and basic incident response - Understanding of HIPAA compliance requirements and high-trust environments - Ability to translate technical security controls into audit-ready documentation - Strong organizational skills — able to independently manage a large volume of evidence across multiple control areas - Available to start mid-July 2026 and commit through December 31, 2026 - U.S.-based, available to work fully remote Preferred Qualifications - Prior experience in a healthcare or health services organization - Familiarity with third-party audit firms and evidence submission processes - Exposure to additional frameworks such as ISO 27001, NIST RMF, GDPR, or PCI DSS - Experience with Azure environments or cloud-hosted infrastructure - Background in GRC (Governance, Risk, and Compliance) in addition to hands-on security operations What This Role Is Not - Not a senior security architect or vCISO seat — this is a mid-level, hybrid role - Not the primary interface with the auditor — client leadership owns that relationship - Not initially scoped for vulnerability management or third-party risk — those may be added as the engagement grows