IT Security and Compliance Analyst

Description

The IT Security & Compliance Analyst is a technically skilled member of Lima One Capital's Information Security & Compliance team. This role combines day-to-day security operations with SOX IT General Controls (ITGC) execution, audit support, and access governance. You will help keep Lima One's environment secure, its controls operating effectively, and its evidence audit-ready.

You will work alongside the existing security team and report directly to the Vice President of Information Security & Compliance. The ideal candidate is equally comfortable triaging a security alert in the morning and walking an auditor through control evidence in the afternoon.

Responsibilities:

Security Operations & Incident Response

• •Monitor, triage, and investigate alerts and incidents across the Microsoft Defender suite (Endpoint, Office 365, Identity, and Cloud Apps) and related security platforms.
• •Perform threat hunting and incident analysis using advanced hunting queries (KQL) and log correlation; determine scope, root cause, and impact.
• •Escalate critical incidents to the VP of Information Security & Compliance and support containment and remediation with IT teams.
• •Tune detection rules, alert policies, and automated responses to reduce noise and improve signal quality.
• •Maintain incident documentation and case tracking; contribute to incident response playbooks, runbooks, and tabletop exercises.

Microsoft Security & Compliance Platform Operations

• •Review and tune Microsoft Purview controls, including data loss prevention (DLP) policies and alerts, sensitivity labels, retention, audit logging, and eDiscovery support.
• •Review Microsoft Entra ID security posture, including Conditional Access, Identity Protection risk signals, and privileged access configuration.
• •Assess security configuration and compliance posture across Microsoft 365, Intune-managed endpoints, and Azure; document gaps and track them to closure.

Vulnerability & Threat Management

• •Review vulnerability scan and penetration test results; track remediation to closure.
• •Perform risk-based prioritization of findings using threat intelligence and asset criticality; coordinate resolution with system owners and IT teams.
• •Report on vulnerability trends, aging items, and SLA adherence.

SOX ITGC & Audit Support

• •Execute assigned ITGCs and maintain evidence supporting control operation.
• •Assist with quarterly and annual control testing and audit readiness activities.
• •Gather audit artifacts, coordinate requests across IT teams, and support internal and external auditors.
• •Track control exceptions and audit findings through remediation.
• •Maintain a well-organized, audit-ready evidence repository.

Change Management & Internal Control Reviews

• •Review change management records and logs; validate approvals and supporting documentation.
• •Perform IT ticket quality and compliance reviews; identify process exceptions, control gaps, and recurring trends.
• •Document findings and recommend practical corrective actions.

Continuous Improvement

• •Identify opportunities to make control execution and evidence collection simpler, more consistent, and more repeatable.
• •Recommend process and configuration improvements to the VP of Information Security & Compliance and system owners.

Metrics & Reporting

• •Produce monthly operational reports and track cybersecurity and compliance KPIs.
• •Support executive reporting and maintain compliance and audit-readiness dashboards.

Requirements

• •5+ years of experience in Information Security, Security Operations, GRC, or IT Audit, including hands-on technical security work.
• •Strong hands-on experience with Microsoft Defender (Endpoint, Office 365, Identity, and/or Cloud Apps), including alert investigation and advanced hunting with KQL.
• •Working experience with Microsoft Purview (DLP, sensitivity labels, audit, retention, or eDiscovery) and Microsoft 365 security and compliance tooling.
• •Strong knowledge of Microsoft Entra ID and identity and access management concepts, including Conditional Access, MFA, and privileged access.
• •Demonstrated experience with security incident monitoring, investigation, and response.
• •Experience with vulnerability management processes, including prioritization and remediation tracking.
• •Hands-on experience supporting SOX IT General Controls, including evidence collection and control testing.
• •Experience conducting user access reviews and reviewing change management controls.
• •Strong written and verbal communication skills, with the ability to produce clear, audit-quality documentation and brief senior leadership.
• •Ability to work independently, manage competing priorities, and exercise sound judgment in an audit-driven environment.

Preferred Experience

• •Experience in financial services, banking, lending, or another regulated industry.
• •Internal or external audit support experience; familiarity with working directly with external auditors.
• •Experience with Microsoft Sentinel or another SIEM platform, plus Azure, Active Directory, and Intune.
• •Scripting and automation experience (PowerShell preferred) for security operations, evidence collection, and reporting.
• •Experience with security automation and orchestration (e.g., Defender automated investigation and response, Logic Apps, or similar).
• •Experience assessing and governing AI tools and features, including AI risk assessments, acceptable use, vendor AI reviews, and data handling and privacy considerations.
• •Familiarity with securing generative AI tools, including data oversharing risk, sensitivity labels, and DLP controls in Purview.
• •Working knowledge of AI governance and risk frameworks such as the NIST AI Risk Management Framework or ISO/IEC 42001.
• •Experience using AI-assisted tools responsibly to improve security analysis, detection, or compliance workflows.
• •Relevant certifications, such as Microsoft SC-200, SC-300, SC-401, or AZ-500; CompTIA Security+ or CySA+; CISA, CISSP, or CRISC; or AI governance credentials such as IAPP AIGP or ISACA AAIA.

Core Competencies

• •Direct and clear communicator who works well across IT, Finance, and business teams.
• •Sound judgment on when to escalate, and discipline in documenting what was done and why.
• •Integrity and discretion when handling confidential company, customer, and employee information.
• •Curious and proactive; looks for ways to make controls simpler, stronger, and more repeatable.

What We Offer:

Industry Leading Benefits:

• •Medical, Dental and Vision Insurance
• •Life Insurance, Short-Term Disability, and Long-Term Disability
• •Hospitalization and Accidental Insurance
• •Flexible Spending Accounts – Health and Dependent Care
• •Health Savings Account
• •Safe Harbor 401K with company match
• •Growing Families Support (including paid parental leave, infertility support and assistance, childcare reimbursement, and elder care)
• •Pet Insurance

Work Life Balance: 12 paid time off days and 5 sick days, in addition to 12 paid holidays – that’s about a month of time to rest, relax, and recharge every year.

Career Development: We prioritize the growth and success of our team members. You'll benefit from continuous learning opportunities, dedicated mentorship, and the chance to refine your skills and advance your career.

New Headquarters: Join us in our brand new, thoughtfully designed office in the heart of Downtown Greenville (parking is paid for!)

Why Lima One?

At Lima One Capital we’re relentlessly focused on a simple but powerful goal: to be the nation’s premier lender for real estate investors. Inspired by that vision, every member of our team is driven by our mission to create opportunities for our customers and employees by educating, empowering, and financing real estate investors who are building, improving, and stabilizing their neighborhoods and communities nationwide.

· Loans Funded: $10+ billion in loans funded, 30k loans closed since 2010

· Geography: 46 states + D.C. where