Security Compliance Analyst - Information Technology - Dallas

Winstead PC is hiring a Security Compliance Analyst to support its information-security compliance program. The role assists with security audits, client compliance requests, ISO processes, vendor security reviews, and governance, risk, and compliance activities in collaboration with teams across the organization.

What you'll do:

• Coordinate security audits by gathering evidence, tracking responses, and following up on open items
• Respond to client security questionnaires and requests for information, with senior review
• Serve as a point of contact for routine security-compliance questions
• Maintain an organized repository of approved responses, policies, and audit records
• Support the legal team during client security reviews and coordinate subject-matter-expert input
• Identify recurring client requests and help update standard response materials
• Help maintain ISO compliance processes (e.g., ISO/IEC 27001) and keep ISMS documentation current
• Support internal reviews, audits, and continual-improvement activities
• Monitor updates to security standards and customer requirements
• Maintain compliance calendars and track corrective actions, remediation, and audit findings
• Support policy lifecycle activities, including periodic review, version control, approval tracking, and publication
• Work with Engineering, IT, and Product teams to understand systems and data flows

What they're looking for:

• 0–2 years of experience or exposure to information security, IT, compliance, audit, risk management, or related functions (including internships, academic projects, or entry-level roles)
• Strong organizational skills and attention to detail
• Strong written and verbal communication skills
• Ability to manage multiple tasks, track follow-ups, and meet deadlines with guidance
• Proficiency with Microsoft Office, particularly Excel, Word, Outlook, and Teams
• Willingness to learn security, compliance, vendor risk, and audit concepts
• Ability to handle sensitive and confidential information professionally
• Relevant experience is highly valued and may be considered in lieu of a degree
• A bachelor's degree in Information Security, Cybersecurity, IT, Business, Risk Management, or a related field is a plus but not required — equivalent hands-on experience is weighed equally or higher
• Entry-level certifications such as CompTIA Security+, ISC2 Certified in Cybersecurity (CC), ISO 27001 Foundation, or Microsoft Security Fundamentals (or willingness to pursue them)
• Familiarity with common frameworks such as ISO 27001, ISO 27701, SOC 2, or the NIST Cybersecurity Framework
• Experience maintaining documentation, inventories, records, or audit-related materials