Security Risk Analyst

The posting, as Audax Group wrote it

Founded in 1999, Audax Group is a leading alternative investment manager with offices in Boston, New York, San Francisco, London and Hong Kong. With approximately $42 billion of assets under management and more than 475 employees, Audax is a leading capital partner for middle market companies, operating through three business lines: Audax Private Equity, Audax Private Debt, and Audax Strategic Capital.

For more information, visit www.audaxgroup.com or follow Audax Group on LinkedIn .

POSITION SUMMARY

The Information Security Risk Analyst owns and executes the risk assessment activities that drive the ongoing maturity of the firm's information security risk program. This role independently performs risk assessments of vendors, applications, and internal systems, and maintains the supporting artifacts needed to track remediation and report risk in a consistent, repeatable way. The position also leads SOC 1 IT control evidence collection, audit coordination, due diligence questionnaires, and change management control validation.

The Risk Analyst partners closely with IT, Legal, Compliance, IR, and business stakeholders to ensure security risks are identified, documented, communicated, and addressed through practical mitigation plans. This role helps improve audit readiness, supports investor and customer assurance needs, and enables the business to operate efficiently while meeting governance and security expectations.

RESPONSIBILITIES

• Risk Assessment & Remediation
• Perform independent information security risk assessments for vendors, applications, systems, and business processes.
• Conduct application security vetting, including architecture reviews, control validation, and risk documentation.
• Apply consistent risk rating methodology (likelihood, impact, inherent, residual) and document scoring rationale.
• Partner with control owners to define practical remediation plans, including interim compensating controls.
• Facilitate recurring risk review check-ins with control owners to validate progress on remediation plans.
• Support risk exception and risk acceptance workflows (evidence collection, summaries, and tracking).
• Governance, Policy & Strategy
• Maintain and update risk registers, remediation tracking, and control mappings.
• Map assessment results to common security and control frameworks (e.g., NIST CSF, ISO 27001, SOC 1 & SOC 2).
• Contribute to policy, standard, and control development initiatives.
• Identify process improvements and support continuous improvement of GRC tooling.
• Contribute to documentation of SOPs, templates, and playbooks.
• Develop risk narratives that translate technical controls into business-relevant language.
• Support business continuity and resilience efforts (BIA input and tracking).
• Partner with business stakeholders to reduce onboarding cycle time through repeatable processes.
• Audit, Assurance & Investor Relations
• Lead SOC 1 IT control evidence gathering across bus

[…]
osting. Consistent with applicable law, compensation may vary and will be determined based on but not limited to, the skills, qualifications, and experience of the applicant along with the requirements of the position, and Audax reserves the right to modify this pay range at any time. An employee may also be eligible for annual discretionary incentive compensation based on performance.

Audax offers a wide range of employee benefits, including health insurance, life insurance, disability insurance, paid time off (including sick leave, parental leave, volunteer leave, and vacation), charitable donation match, family support services (including Bright Horizons and Benefit Advocate Center), and a 401(k) in addition to other benefits.
This job description is not designed to cover or contain a comprehensive listing of activities, duties or responsibilities that are required of the employee. Duties, responsibilities and activities may change or new ones may be assigned at any time with or without notice.

Audax Management Co. is an equal opportunity employer.

Please note that Audax Group and its affiliated entities do not accept unsolicited resumes from a third-party recruiting agency not currently under a signed agreement. Any unsolicited resume that is sent to directly to Audax Group or one of its affiliated entities, or its employees, including those submitted to hiring managers by a third-party recruiting agency not currently under a signed agreement, will be considered property of Audax Group. If a third-party recruiting agency submits a resume without an agreement, Audax Group or its affiliated entities explicitly reserves the right to pursue and hire those candidate(s) without any financial obligation to the third-party recruiting agency. Any third-party recruiting agency should contact either a member of the Talent Acquisition or Human Resource team at Audax Group, in conjunction with a valid, fully executed contract for service based upon a specific job opening.