Cybersecurity Analyst
Bertram Capital Management · Colorado, California preferred, or remote
About this role
**Cybersecurity Analyst** **Location** - Hybrid: Broomfield, Colorado or Foster City, California preferred - May also consider remote candidates from: California, Colorado, Idaho, Minnesota, Illinois, Massachusetts, Florida, New York, Wisconsin, Texas, Arizona, Indiana, or Ohio **Firm Overview** Bertram Capital is a private equity firm investing in lower middle market companies. Since 2006, the firm has raised over $4B in capital commitments. Bertram combines venture capital operating methodologies with private equity financial discipline to help portfolio companies unlock growth and value through technology enablement (digital marketing, e-commerce, big data/analytics, application development, and platform optimization). **Position Description** Bertram Labs (technology partner to Bertram Capital) is hiring an **associate-level Cybersecurity Analyst** focused on **Governance, Risk, and Compliance (GRC)**. You will help build and run the security program aligned to **NIST Cybersecurity Framework (CSF) 2.0** and lead day-to-day work to achieve and maintain **SOC 2 compliance**. You’ll also work directly with each Bertram Capital portfolio company to ensure they meet the required framework. You’ll turn framework requirements into **policies, controls, evidence, and repeatable workflows**, partnering closely with Bertram Labs engineers, IT staff, external auditors, and business leaders. **You won’t be doing this alone.** You’ll work with a Cybersecurity Engineer for technical solutions and recommendations, and with the CISO for oversight, remediation procedures, and maturity level requirements. --- ## Responsibilities ### Governance (NIST CSF 2.0) - Maintain **NIST CSF 2.0 Current and Target Profiles** and track gaps across all six Functions (primary ownership of **Govern (GV)**) - Draft, update, and manage the review cycle for information security policies, standards, and procedures - Maintain the **risk register** (risks, owners, treatment decisions, due dates) and follow up until closed - Map controls across frameworks (**NIST CSF, SOC 2, CIS Controls, ISO/IEC 27001**) so one control can satisfy multiple requirements - Manage third-party supplier due diligence (**Bertram vendors only**): collect vendor info (questionnaires, SOC reports, policies, certifications), analyze against due diligence requirements, and submit a summary to the CISO for approval/rejection ### Portfolio Company Compliance - Own the **security baseline** for each portfolio company (primary responsibility) - After acquisition close, support implementation of the CISO’s initial analysis, then transition into the company’s security baseline and run recurring baseline reviews - Work with portfolio company leadership and IT teams to assess and track compliance with the required framework - Run framework gap assessments and help build practical remediation plans - Manually collect compliance data/evidence, track status and open remediation items, and report progress to Bertram Labs leadership - Share policy templates, control guidance, and best practices so companies don’t start from scratch - Help each portfolio company establish its own third-party vendor due diligence program (process, templates, review criteria). Each company runs its own reviews ### SOC 2 Compliance - Coordinate SOC 2 readiness, **Type I** audit, and ongoing **Type II** audit periods against **AICPA Trust Services Criteria** - Own the **control inventory and evidence calendar** (which con
Listing freshness
CronJobs last confirmed this listing 1h ago. If its source stops confirming the opening for seven days, this page is removed from active inventory.