> Markdown version of [/jobs/ext/2599225-information-security-analyst](https://www.wearedevelopers.com/jobs/ext/2599225-information-security-analyst). Every page supports `.md` or `Accept: text/markdown`. Links point to the HTML versions so they work for humans too. Agent guide: [/agents.md](https://www.wearedevelopers.com/agents.md). --- # Information Security Analyst - **Company:** Rice Park Capital Management LP - **Location:** Minneapolis, MN, United States - **Experience:** Experienced - **Salary:** $60,000.0 - $90,000.0 - **Contract:** Permanent contract - **Skills:** Microsoft Access, Data Analysis, Software System Penetration Testing, Cyber Security, Python (Programming Language), Phishing, Security Information and Event Management, Simulation Software, SQL Databases, Software Vulnerability Management, Scripting, Information Technology, Vulnerability Analysis, Programming Languages - **Published:** August 3, 2026 - **Apply:** https://www.indeed.com/viewjob?jk=9d2fd60992a14237 ## About the Role * Bachelor's degree in Information Technology, Risk Management, Business, Cybersecurity, or a related field (or equivalent experience) * 2+ years of experience in information security governance, risk, or compliance (GRC); experience managing an MSSP or other outsourced security vendor relationship is a strong plus * Working knowledge of regulatory and compliance frameworks such as SOC 2, ISO 27001, NIST CSF, and GLBA * Experience conducting or supporting risk assessments, audits, access reviews, and third-party/vendor due diligence * Strong policy writing, documentation, and project management skills * Familiarity with SIEM and security tooling output sufficient to interpret and act on vendor reporting (hands-on SIEM operation is not required - that is handled by our MSSP) * Strong organizational and communication skills; comfort managing vendors and driving cross-functional accountability * Ability to handle sensitive information with discretion and professionalism * Nice to have: exposure to a scripting or programming language (e.g., SQL, Python) for reporting and data analysis * Nice to have: CISA, CRISC, or a similar governance-oriented certification, * Briefly describe your hands-on experience in information security over the past 2-3 years (e.g., monitoring, incident response, vulnerability management, compliance, etc.). * Which security tools or platforms have you worked with (e.g., SIEM, EDR, vulnerability scanners), and what was your role in using them? * Do you have at least 2+ years of mortgage related experience? ## Description We are seeking a motivated, detail-oriented Information Security Analyst to own and mature Rice Park's information security governance, risk, and compliance ("GRC") program. This is a governance and risk management role, not a security operations role: Rice Park engages a third-party managed security services provider ("MSSP") to handle day-to-day SIEM monitoring, alert triage, and SOC-level response. This position is the internal owner of that vendor relationship and of Rice Park's broader InfoSec program - ensuring the MSSP is delivering against its scope, identifying and closing the gaps the vendor does not cover (e.g., access reviews, policy governance, internal risk assessments), and driving Rice Park's compliance posture across frameworks such as SOC 2 and GLBA, as well as investor and lender due diligence requirements. The Information Security Analyst will work closely with the head of IT and coordinate across the organization to manage risk, maintain governance documentation, and ensure Rice Park meets its regulatory, contractual, and investor-facing security obligations., Vendor & Security Program Management * Serve as the primary internal owner of the relationship with Rice Park's managed security services provider (MSSP), ensuring SLAs are met and proactively identifying coverage gaps * Coordinate third-party penetration testing engagements, including scoping, scheduling, documentation, and remediation tracking * Track and drive remediation of findings from the MSSP, internal audits, and vulnerability scans Governance, Risk & Compliance * Own and maintain the information security policy and procedure suite, including annual review and approval cycles * Lead SOC 2, GLBA, and related compliance efforts, including evidence collection, control testing, and remediation of gaps * Conduct internal and external risk assessments and audits, and maintain the enterprise risk register * Support the development and execution of Business Impact Analyses (BIA), business continuity planning, and related risk management activities * Manage investor, lender, and other counterparty information security due diligence requests and questionnaires, on both an ad hoc and annual basis Access & Control Oversight * Own the user access review program across systems and applications - an area outside the MSSP's scope - including designing the review cadence and ensuring appropriate controls are documented and enforced * Serve as the internal escalation point of contact for the MSSP during a security incident, coordinating internal response, documentation, and communication Awareness & Continuous Improvement * Maintain and deliver Rice Park's security awareness training and phishing simulation program * Collaborate with internal teams across the organization to promote security awareness and ensure adherence to security policies and protocols * Stay current on cybersecurity trends, regulatory developments, and industry best practices relevant to Rice Park's risk profile * Undertake other related duties as assigned to support business operations and evolving organizational needs ## Related Videos - [Security Pitfalls for Software Engineers](https://www.wearedevelopers.com/videos/726-security-pitfalls-for-software-engineers) - [Passkeys: Truly Phishing-Resistant? Implementation and Pitfalls](https://www.wearedevelopers.com/videos/100156-passkeys-truly-phishing-resistant-implementation-and-pitfalls) - [Data Science in Retail](https://www.wearedevelopers.com/videos/586-data-science-in-retail) - [JavaScript? No. Java Scripts! - Scripting with Java](https://www.wearedevelopers.com/videos/2094-javascript-no-java-scripts-scripting-with-java) - [Checkmate: 5 Real Incidents That Can End a Software Company](https://www.wearedevelopers.com/videos/100126-checkmate-5-real-incidents-that-can-end-a-software-company) - [What makes Cybersecurity different for critical infrastructure?](https://www.wearedevelopers.com/videos/571-what-makes-cybersecurity-different-for-critical-infrastructure) ## Related Articles - [9 Ways to Make Money Hacking](https://www.wearedevelopers.com/magazine/333-9-ways-to-make-money-hacking) - [Understanding and Mitigating Common Web Vulnerabilities](https://www.wearedevelopers.com/magazine/565-understanding-and-mitigating-common-web-vulnerabilities) - [Events like RSAC Get You CISOs. Developers Decide What Actually Gets Deployed.](https://www.wearedevelopers.com/magazine/693-events-like-rsac-get-you-cisos-developers-decide-what-actually-gets-deployed) - [The Overflow: Security and Privacy](https://www.wearedevelopers.com/magazine/715-the-overflow-security-and-privacy) - [Data Analyst Salary in the UK](https://www.wearedevelopers.com/magazine/278-data-analyst-salary-in-the-uk) - [Walking Into The Era of Supply Chain Risks](https://www.wearedevelopers.com/magazine/106-walking-into-the-era-of-supply-chain-risks)