Responsibilities

The Information Technology Security Compliance Analyst is a technical and analytical position within Meritage Homes’ IT Security Team focused primarily on issues in Governance Risk & Compliance (GRC) which include risk management, vendor management, compliance management, security awareness, risk & vulnerability assessments. A successful applicant will be technical in nature with a high aptitude for both written and verbal communication skills, with the ability to influence peers across all management levels to support security objectives.

The Security Compliance Analyst position will provide timely and quality service to ensure policy, standards, and configurations are adequately maintained, communicated, and compliant with internal and external policies or regulations. This position is responsible for managing, developing, maintaining, and communicating company security policies, standards, and configurations in accordance with industry standards and best practices.

The Security Compliance Analyst is expected to have experience and knowledge of industry tools to perform their functions including but not limited to GRC Systems, vulnerability, and patch management, vendor risk management applications, and IT Service Management systems. Additionally, the Security Compliance Analyst is expected to have experience with security and risk frameworks.

Responsibilities And Duties

Develop dashboards, KPIs, and KRIs to measure the effectiveness of technology risk mitigation using Power BI
Lead the development, update, and compliance of corporate information security policies, guidelines, and standards.
Primary subject matter expert on GRC Application
Assist/participate/lead in formal risk assessment processes for all departmental and enterprise systems and work closely with system owners to align risks identified with established risk tolerances, and create action plans for remediation.
In conjunction with internal and external audit partners, provide governance for the identification, audit, validation, and remediation of information technology controls required for SOX, PII, NIST Security Control Framework, and any other applicable regulatory compliance frameworks.
Facilitate the coordination, tracking, and automation of all IT and security audits.
Monitor the health of ongoing technical and non-technical controls.
Respond to real-time breaches in IT Security Compliance
Establish custom detections or leverage native detections using security tools for compliance deviations.
Conduct and track information security assessments of third-party vendors to determine their ability to protect data.
Work with stakeholders to coordinate mitigation efforts on issues identified during vendor due diligence reviews.
Participates in projects and assessments to establish risk determination and remediation.
Development of and maintenance of an IT Security risk register
Using industry best practices and tools, be able to utilize technology-based tools to validate controls are in place as established.
Work with technical teams proactively to ensure baseline configurations are kept current and configurations for new technologies are designed and built before integration into the company environment
Develop a comprehensive information security awareness program and run year-round campaigns. Create communications on behalf of IT Security for awareness activities, initiatives, or other required security announcements.
Maintain security and compliance metrics that are meaningful and actionable for all levels of management. Metrics should establish baselines, highlight progress, and drive behaviors.
Coordinate with internal and external audit and compliance groups on the improvement of information technology controls
Analyze, evaluate, prioritize, and process results from security penetration tests or assessments.
Work with business, technical, and other stakeholders to drive Information Security projects with a risk-based service delivery view
Anticipate, research, and understand industry and regulatory compliance trends, serving as an expert on Information Security GRC capabilities and best practices, including analysis and documentation of best practices
Coordinate program elements in a fast-paced environment using iterative techniques
Provides Level 3 support functions

Additional duties as assigned

Qualifications

Bachelor’s degree in computer science, Information Systems, Information Security, or a related field and/or experience in lieu of degree.
Industry-relevant certifications such as CISA, CISSP, CRISC, M365 Compliance (SC-400), Microsoft Cybersecurity Architect (SC-100), CCSP
3+ years’ experience in an Information Technology Security role, preferably in compliance, audit, and/or control roles.
And 2+ years in information technology engineering role, such as System Engineer, Cloud Engineer, or Network Engineer.

Essential

Action-oriented mindset and drive to get things done
Ability to prioritize and execute tasks with a self-motivated approach to work
Strong understanding of security frameworks such as NIST CSF, CIS, ISO 270001, SOC II Type 2, and benchmarks such as CIS Benchmarks, STIG, and Microsoft Baselines.
Experience with Microsoft 365 Compliance Tools such as Microsoft Purview, Information Protection, Data Loss Prevention, Retention, Insider Risk, and Privacy.
Strong understanding of SOX, CCPA, and PCI compliance & controls
Strong knowledge of ITIL and service management principles.
Proficient in Excel, Word, and PowerPoint experience required
Strong written and verbal communication
Strong problem-determination and resolution skills.
Ability to develop and maintain collaborative relationships with peers and colleagues across the organization, as well as internal and external clients and with all levels of management
Ability to influence peers to support the goals and objectives of the organization and the IT Security Team

Preferred

Demonstrated experience with ServiceNow GRC, or other industry GRC systems.
Strong understanding of OWASP 10 vulnerabilities and mitigations.
Experience with security tools and systems, including M365 Defender suite, vulnerability management, network defenses, and related APIs
Scripting language experience such as Python, PowerShell, or BASH is a plus.
Security implementation project experience to include security automation, audit, vulnerability management, application security, etc.
Experience conducting reviews of Secure SDLC/SecDevOps practices and Database Auditing preferred.

Overview

Are you looking for an incredible career opportunity? Then Meritage Homes is the place for you! From the homes we build to the careers we offer, we believe in quality. Meritage Homes is the ENERGY STAR® Partner of The Year in Sustained Excellence for being a leader in protecting the environment and advancing energy efficiency in homebuilding. We are looking for candidates who are excited about furthering their careers, as well as being a part of an organization that helps people live happier, healthier lives. With over 100,000 homes built, Meritage Homes is looking for professionals who are self-starters and want to help our organization grow by providing new and innovative ideas.

When joining Meritage Homes, you and your career can benefit in several ways, including:

A work environment that encourages creativity and innovative ideas from every level
An organization that lives by its core values everyday
Team atmosphere where every individual is considered a vital asset
State of the art technology to provide an optimal working environment
A competitive pay structure
Strong benefits
Flexibility in work-life integration
Team-oriented environment where all individuals play an integral role in the company
Opportunity to further your career in a growing national organization
Maintain a competitive drive to be the best

Meritage Homes jobs

IT Security Compliance Analyst