Junior Information Security & Compliance Analyst

We need to output only HTML fragment, with headings

for sections: About the role, Responsibilities, Requirements, Qualifications, Skills, Benefits, Pay, Schedule. Use

for each heading. Use

• for any list of duties/requirements/benefits. Use

  for prose. Do NOT repeat job title as heading. Do NOT put Job ID / requisition numbers as headings — fold minor metadata into short

  or drop it. Preserve ALL substantive information; do NOT invent or summarize away detail. Remove cookie/navigation/legal/EEO/equal-opportunity/scam-warning boilerplate, duplicated lines, and application instructions. Include a section ONLY when posting has real, specific content for it — never emit heading followed by filler/placeholder text (e.g., "commensurate with experience", "not specified", "N/A", "varies", "TBD") and never create Pay/Schedule/Benefits sections unless posting actually states them. Prefer a few substantive sections over many thin ones. We need to parse the posting. Content: - Intro paragraph: At Veracity, we aim to be a different kind of insurance partner... (culture description). This is "About the role"? Actually it's about company. Could be "About the role" or maybe "About the company". The instruction says use headings like About the role, Responsibilities, Requirements, Qualifications, Skills, Benefits, Pay, Schedule. So we can put "About the role" heading and include the company description and role overview. - Then "We're seeking a precise, persistent, and coachable Junior Information Security & Compliance Analyst..." That's part of role description. - Then "Reporting to the Information Security & Compliance Analyst, this role is the execution engine..." etc. - Then "Key Responsibilities" heading (but we will use

  Responsibilities

  and list bullet points. - Then "Requirements And Qualifications" heading: we can split into Requirements and Qualifications? The instruction says we can have separate headings Requirements and Qualifications. We need to decide if we have both. The posting lumps them together: "Requirements And Qualifications". We could treat as one section "Requirements" (or "Qualifications") but we have both headings available. We could split: Requirements (0-2 years experience, bachelor's degree or equivalent, familiarity with cloud platform, ability to own recurring work, comfort with spreadsheets, communication skills, judgment, coachability, composure). Qualifications maybe could be same? But we should not create thin sections. Better to combine into one section, maybe "Requirements". Or we could have "Requirements" and "Qualifications" both with content; but we risk duplication. Since the posting lumps them, we could put all under "Requirements". Or we could put under "Qualifications". The instruction: "Prefer a few substantive sections over many thin ones." So better to have one section for requirements/qualifications. - Then "Perks" heading: we have list of benefits: Health, dental, and vision plans; Amazing work-life balance with 4 weeks of Paid Time Off; 10 Paid Company Holidays with 2 floating holidays; 401K Programs with employer match; Personal assistance programs for support in a healthy personal and work life. This is benefits. So we can have

  Benefits

  with a
  . - Then "Why Veracity?" heading: that's more about culture, maybe could be part of About the role or separate? Could be "About the role" already includes company description; but "Why Veracity?" is more about culture and vision. Could be part of About the role as well. But we already have About the role; we could add that content there. However we must not create thin sections. So we can incorporate that into About the role. - Then "Compensation Range: $55k/yr - $70k/yr". That's Pay. So we need a Pay section with that info. Must not create Pay section unless posting actually states them. It does state compensation range. So we include

  Pay

  with

  Compensation range: $55k/yr - $70k/yr

  . - Schedule: Not mentioned. So we should NOT create Schedule section. - Skills: Not explicitly listed as separate; but we could infer from requirements. However we should not create Skills section unless posting actually states them. The posting does not have a separate "Skills" heading. So we should not create Skills section. Thus sections: About the role, Responsibilities, Requirements (or Requirements And Qualifications), Benefits, Pay. We need to ensure we preserve all substantive information. Let's extract. About the role: Should include company description and role overview. Company description: "At Veracity, we aim to be a different kind of insurance partner – one that is free from outside investors, venture capital, or the pressures of a corporate parent. Ours is a culture of empowerment – one that believes in effort, results, and accountability. We believe that transparency fosters trust, trust fosters growth, and that growth drives innovation. Our commitment to rigorous evaluation and relentless execution lead to rapid evolution. We answer only to the small business owners we serve, and this independence allows us to stay focused on what matters most: helping their businesses thrive by providing expert guidance and best-in-class insurance policies. We’re growing fast and want you to be a part of it!" Role overview: "We're seeking a precise, persistent, and coachable Junior Information Security & Compliance Analyst to join our team. Reporting to the Information Security & Compliance Analyst, this role is the execution engine of Veracity's security and compliance program – carrying the recurring, deadline-driven work that keeps the program credible and audit-ready across Veracity, Insurance Canopy, and InsCipher. This is a deliberately structured entry-level role – the incumbent is not expected to arrive with deep security experience, but is expected to be precise, persistent, and coachable, and to build real technical and audit depth on the job. Over time, this person should take full ownership of the recurring compliance calendar and become the company's second line of security response." We can combine. Responsibilities: list each bullet from "Key Responsibilities". Let's extract each line: - Monitor security dashboards, alerts, and logs across AWS, Microsoft 365, Google Workspace, and Grafana – triage, document disposition, and escalate per established runbooks - Run recurring vulnerability scans across cloud, endpoint, and application surfaces – maintain the remediation tracker, drive follow-up with system owners, and verify and close findings within defined SLAs - Serve as first-line triage for employee-reported phishing and security questions – escalating confirmed issues promptly with context already gathered - Support incident response as first responder and scribe – capture the timeline, preserve evidence, maintain ticket hygiene, and draft the post-incident summary and lessons learned for senior review - Maintain coverage and health of security tooling including MFA enrollment, endpoint agents, logging agents, and email security – and report gaps - Execute user access provisioning, role changes, and deprovisioning tied to onboarding and termination – confirming same-day removal of access for departures - Run quarterly user access reviews end to end – pull system reports, distribute to owners, chase responses, document and route exceptions, and file completed evidence - Enforce least-privilege and role-based access practices in day-to-day requests – flagging standing privileges and orphaned accounts for remediation - Maintain accurate records of privileged accounts, service accounts, and third-party access across business units - Collect, organize, and continuously refresh audit evidence for SOC 2 and PCI DSS – owning the evidence repository so that auditor and customer requests can be answered efficiently - Support SOC 2 and PCI DSS audit cycles – track requests, meet internal due dates, and prepare materials for auditor communications led by senior staff - Maintain the policy and procedure library including version control, the annual review calendar, approval records, and employee attestation tracking - Support vendor risk assessments – collect SOC 2 reports, DPAs, and security questionnaires, maintain the vendor inventory, and flag gaps for senior review - Perform assigned internal control testing and document results with evidence that supports audit requirements, under the guidance of senior staff - Draft responses to customer and carrier security questionnaires and diligence requests for review by the Information Security & Compliance Analyst - Maintain the asset inventory and security awareness training program including completion tracking and follow-up with non-completers - Build and maintain security and compliance metrics reporting – open vulnerabilities, SLA performance, access review status, and training completion - Write and maintain runbooks, SOPs, and checklists for recurring work so that it is repeatable and transferable - Partner with IT, Engineering, Compliance, Legal, and Service teams so that controls are applied consistently without unnecessary friction to the business - Identify repetitive security and compliance tasks that can be automated or streamlined and propose improvements - Perform other duties as requested, directed, or assigned We need to preserve all. We'll put each as
  • . Requirements And Qualifications: extract: - 0–2 years of professional experience – internships, IT helpdesk or support, systems administration, or audit and compliance support all count; this role is intended to be a first or second job in security - Bachelor's degree in Information Systems, IT, Cybersecurity, or a related field – or equivalent practical experience or a relevant certification in lieu of a degree - Working familiarity with at least one major cloud or productivity platform – AWS, Microsoft 365/Azure, or Google Workspace – including where users, permissions, and logs live - Demonstrated ability to own recurring, detail-heavy work to completion without reminders - Comfort with spreadsheets, ticketing systems such as Jira, and documentation tools - Excellent verbal and written communication skills – able to ask a busy system owner for evidence and actually get it, and to write documentation an auditor will accept - Sound judgment and discretion handling sensitive, regulated, and confidential information including customer PII and NPI - Coachability and genuine curiosity about security – willing to be taught and willing to say "I don't know" early rather than let an item quietly slip - Composure under pressure during audits, incidents, and deadlines We'll put as
    • . Benefits: list: - Health, dental, and vision plans - Amazing work-life balance with 4 weeks of Paid Time Off - 10 Paid Company Holidays with 2 floating holidays - 401K Programs with employer match - Personal assistance programs for support in a healthy personal and work life Pay: Compensation Range: $55k/yr - $70k/yr We should not include EEO boilerplate etc. Now produce HTML fragment. We need to use

      for each section heading. Use

      • for lists. Use

        for prose. We must not include any extra text outside HTML. Let's craft. First section:

        About the role

        then

        with the combined description. We need to ensure we don't duplicate lines. We'll combine company description and role overview into one or two paragraphs. Could be two

        but it's okay. We'll put company description in one

        , role overview in another

        under same heading. Second:

        Responsibilities

        then
        with each responsibility as
        • . Third:

          Requirements

          then
          with each requirement. Fourth:

          Benefits

          then
          with each benefit. Fifth:

          Pay

          then

          with compensation range. We must not add Schedule. Check for any duplicated lines: ensure we didn't include any boilerplate like "We are proud to be an equal-opportunity employer." etc. We removed. Check for any minor metadata like Job ID: none. Now produce final HTML. Be careful to escape any special characters? Not needed.