Cybersecurity Analyst

Location:

Hybrid: Broomfield, Colorado or Foster City, California preferred
The team may also consider candidates to work remotely from the following states: California, Colorado, Idaho, Minnesota, Illinois, Massachusetts, Florida, New York, Wisconsin, Texas, Arizona, Indiana, or Ohio.

Firm Overview

Bertram Capital is a private equity firm targeting investments in lower middle market companies. Since its inception in 2006, the firm has raised over $4B of capital commitments. Bertram has distinguished itself in the private equity community by combining venture capital operating methodologies with private equity financial discipline to empower its portfolio companies to unlock their full business potential. This approach is unique in that Bertram is not singularly focused on achieving its investment returns through financial engineering and the extraction of near-term cash flow. Instead, Bertram focuses on reinvestment and technology enablement to drive growth and value through digital marketing, e-commerce, big data and analytics, application development and internal and external platform optimization.

Visit www.bcap.com for more information.

Position Description

Bertram Labs, the technology partner to Bertram Capital, is hiring a Cybersecurity Analyst focused on governance, risk, and compliance (GRC). You will help build and run our security program against the NIST Cybersecurity Framework (CSF) 2.0 and lead the day-to-day work of achieving and maintaining SOC 2 compliance. You will also work directly with each Bertram Capital portfolio company to make sure it meets the required framework.

This is an associate-level role for someone early in their security career who already speaks the language of frameworks. Your core strengths are organization, clear communication, and process discipline. You will turn framework requirements into policies, controls, evidence, and repeatable workflows, and you will work closely with Bertram Labs engineers, IT staff, external auditors, and business leaders.

You won't be doing this alone. You will work directly with our Cybersecurity Engineer to determine the right technical solutions and recommendations to meet the requirements of each security program. You will also work directly with our CISO, who provides oversight, to determine the correct remediation procedures and maturity level requirements for each portfolio company.

Responsibilities

Governance (NIST CSF 2.0)

Maintain our NIST CSF 2.0 Current and Target Profiles, and track gaps across all six Functions, with particular ownership of Govern (GV).
Draft, update, and manage the review cycle for information security policies, standards, and procedures.
Maintain the risk register: document risks, owners, treatment decisions, and due dates, and follow up until closed.
Map controls across frameworks (NIST CSF, SOC 2, CIS Controls, ISO/IEC 27001) so one control satisfies many requirements.
Manage the firm's third-party supplier due diligence process (Bertram vendors only): collect vendor-supplied information (security questionnaires, SOC reports, policies, certifications), analyze it against the requirements of our due diligence process, and submit an analysis summary to the CISO, who approves or rejects the vendor.

Portfolio company compliance

Own the security baseline for each portfolio company (a primary responsibility of this role). After an acquisition closes, support implementation of the CISO's initial analysis, then transition it into the company's security baseline and run the scheduled, recurring baseline reviews from there.
Work directly with each portfolio company's leadership and IT teams to assess and track compliance with the required framework.
Run framework gap assessments at each company and help build practical remediation plans.
Manually collect compliance data and evidence from each portfolio company, and track each company's status and open remediation items, and report progress to Bertram Labs leadership.
Share policy templates, control guidance, and best practices so portfolio companies don't start from scratch.