THE ROLE 

As an AI Governance Analyst within Everpure’s Global Information Security Office (GISO), you will be the primary guardian of our safe and innovative AI adoption. You’ll bridge the gap between cutting-edge technology and enterprise safety by managing the end-to-end lifecycle of AI tooling requests and risk assessments. Partnering closely with Legal, Privacy, and Engineering, you ensure our teams move fast while remaining within our security guardrails. Your mission is to transform governance from a "no" to a "how-to" for the entire organization.

WHAT YOU’LL DO

• Accelerate Secure Innovation: Manage the end-to-end intake and risk assessment lifecycle for new AI tools and use cases, ensuring every service deployed on the Everpure Platform aligns with our security, privacy, and data handling standards.
• Proactive Risk Management: Safeguard the enterprise by identifying and remediating unapproved AI usage through proactive monitoring and stakeholder collaboration, successfully converting "shadow AI" into governed, secure business assets.
• Global Enablement & Literacy: Drive organizational AI literacy by developing self-service documentation, FAQs, and high-impact training programs that translate complex security requirements into actionable guidance for both technical and non-technical teams.
• Operational Excellence: Optimize the AI Governance program’s efficiency by maintaining a comprehensive inventory of approved vendors and tracking key performance indicators—such as time-to-approval and exception trends—to drive continuous process improvement.

WHAT YOU BRING

• Security & AI Domain Expertise: A strong professional background in information security, risk management, or data governance within a SaaS environment, paired with a functional understanding of Large Language Models (LLMs) and their associated security risks.
• Analytical Framework Proficiency: Proven ability to apply security and privacy frameworks (such as NIST, ISO 27001, or SOC 2) to evaluate third-party AI vendors and internal data flows for potential vulnerabilities.
• Strategic Communication & Partnership: Exceptional ability to distill complex policy into clear, persuasive communications for diverse stakeholders, demonstrating a partnership-first mindset that enables business units to achieve their goals safely.
• Organizational Agility: Exceptional program management skills with the capacity to prioritize high-volume requests and maintain meticulous documentation in a fast-paced, rapidly evolving regulatory and technological landscape.
• Bonus Skills: A blend of technical and policy expertise, including experience with AI governance frameworks (e.g., EU AI Act, sectoral AI, or data protection guidance)  and SaaS risk assessments. Working knowledge of DLP/CASB tools and a passion for building security awareness content that empowers teams to innovate safely.
• Location: We are primarily an in-office environment and therefore, you will be expected to work from the Lehi, UT office in compliance with Everpure’s policies, unless you are on PTO, or work travel, or other approved leave.

#LI-ONSITE #LI-KQ1

THE ROLE

At Everpure, Information Security is a foundational business priority. The Security team is a core engineering-focused group deeply embedded in ensuring the security of our corporate environment and Everpure services. We are dedicated to staying on the cutting edge of security technology and proactively addressing the evolving threat landscape.

We are seeking a proactive, detail-oriented Security Analyst, Compliance to independently run compliance certification programs with minimal supervision and actively support the broader compliance efforts of the team.

WHAT YOU'LL DO

• Lead a security certification program vertical  (e.g., SOC 2, ISO 27001, FedRAMP, Common Criteria) end to end with minimal supervision ensuring a successful outcome.
• Support other certification program verticals to streamline audit certification cycles.
• Collaborate and maintain communication with cross-functional teams (e.g., Engineering, Legal, Product) and external auditors/stakeholders to ensure smooth project execution and successful outcomes.
• Assist and support internal teams through independent assessments and audits. Translate complex security and compliance controls into actionable technical solutions and implementation strategies.
• Develop, track, and report on key compliance metrics (KCMs), continuously driving process improvements to align with evolving industry standards and best practices.
• Author and maintain comprehensive compliance documentation, including control narratives, audit evidence, and supporting materials, ensuring they are accurate, up-to-date, and audit-ready.
• Independently drive on recurring tasks and events such as access reviews and vulnerability scanning across multiple business units with differing scopes.
• We are primarily an in-office environment and therefore, you will be expected to work from the Lehi, UT office in compliance with Pure’s policies, unless you are on PTO, or work travel, or other approved leave.

WHAT YOU BRING

• 5+ years of experience in IT audit, risk management, or IT compliance roles, with demonstrated experience running compliance certification programs and previous audit experience.
• In-depth understanding of security controls and key compliance frameworks (e.g., NIST, SOC2, ISO 27001, FedRAMP, FIPS, Common Criteria) as well as cloud platforms (e.g. AWS, Azure, GCP, etc.)
• Proven experience in designing technical controls to satisfy compliance requirements.
• Strong written and verbal communication skills, with the ability to engage effectively with both internal teams and external auditors.
• Ability to identify and recommend tools, processes, and software to improve and automate compliance practices.
• Security Operations or Engineering background preferred but not required
• Relevant certifications such as CISSP, CISA, or CISM, ISO/IEC 27001 Lead Implementer or Lead Auditor  are preferred but not required.

#LI-ONSITE

#LI-TH3

ABOUT THIS ROLE 

LVT is actively seeking a highly motivated and detail-oriented Information Security Analyst (GRC) to join our growing Information Security team. This role will report directly to the Information Security Manager (GRC). This position is designed for an individual eager to delve deeply into the operational aspects of Governance, Risk, and Compliance, directly supporting LVT’s steadfast commitment to security excellence and regulatory adherence as the business continues its innovative scaling.

LVT values managing risk in alignment with our customer’s and stakeholder’s expected levels. We design, implement, and monitor controls that reduce real risk. The Information Security Analyst (GRC) will work with Management to operate key GRC processes. The primary focus of this hands-on position will be answering customer security questionnaires, performing risk assessments and internal audits, developing and maintaining policies, being a liaison for our external auditors, and helping to identify, manage, and reduce risk across our environment.

ROLE RESPONSIBILITIES

• Support LVT’s annual SOC 2 audit.
• Facilitate effective communication and coordination with internal SOC 2 control owners. 
• Proactively assist in identifying, analyzing, and resolving audit concerns or control deficiencies, proposing initial remediation steps. 
• Document audit outcomes, lessons learned, and recommended improvements post-audit. 
• Execute control testing, including evidence collection and documentation.
• Develop  LVT’s security policies, submitting them for approval, and ensuring alignment with organizational standards.
• Maintain and update the risk register to ensure accurate and timely recording of identified risks and their mitigation status.
• Maintain GRC documentation to ensure accuracy, accessibility, compliance with internal controls
• Execute quarterly  user access reviews.

OUR IDEAL CANDIDATE

• 1-3 years of experience with Information Security, GRC or IT Audit roles.
• Highly organized and can multitask and juggle multiple priorities.
• Familiarity with leveraging and applying AI tools and technologies to automate routine GRC tasks and improve program efficiency.
• Practical experience with SOC 2 audit processes including proficiency in control testing, evidence collection, and internal coordination.
• Familiarity with information security and risk frameworks.
• A foundational understanding of business operations and how security controls impact business functions. 
• Effective verbal and written communicator.
• Desire to work directly with key stakeholders, including customers.
• Hunger to learn and grow their abilities.
• Consistently demonstrates high integrity and transparency.
• Willing to take on tasks with a positive attitude, but also speaks up on concerns.
• A Bachelor's degree in Information Security, Computer Science, Information Technology, Business, or a related field, or equivalent practical experience, is preferred. 
• Experience working with GRC platforms (e.g., Drata, Vanta, ZenGRC) and project management tools (e.g., Jira, Asana) is helpful.
• Relevant professional certifications such as CompTIA Security+, CISA, CC, or CRISC are a plus