IT Security Analyst – Remote (Canada/Philippines)

About the role

Harbor is looking for an IT Security Analyst to join its internal IT Operations team. The role is fully remote (Canada or Philippines) and works during US Eastern business hours. You will help strengthen Harbor’s security posture through vulnerability management, third‑party risk management and client‑facing security assurance.

Key responsibilities

• Administer and operate Qualys for continuous vulnerability scanning across infrastructure, endpoints and cloud environments.
• Analyze scan results, prioritize findings, coordinate remediation with infrastructure and engineering teams and report metrics to leadership.
• Manage the third‑party risk lifecycle, including vendor onboarding, assessments, periodic reviews and maintenance of a vendor risk inventory.
• Respond to client security questionnaires, RFPs and due‑diligence requests, maintaining a centralized knowledge base of standard answers.
• Review, update and maintain security policies, standards and procedures aligned with frameworks such as SOC 2 and ISO 27001.
• Support audits, client security reviews and assist in incident investigation and response.
• Continuously improve vulnerability management processes, SLAs, exception handling and risk‑acceptance workflows.

Required profile

• Hands‑on experience with vulnerability scanning tools, especially Qualys.
• Familiarity with third‑party risk assessment frameworks (e.g., SIG, CAIQ).
• Understanding of security frameworks such as SOC 2 and ISO 27001.
• Strong analytical abilities and clear communication skills for internal and external stakeholders.
• Ability to work remotely in Canada or the Philippines while aligning with US EST business hours.

Required skills

• Qualys vulnerability scanning
• Third‑party risk management (TPRM)
• SIG and CAIQ assessment frameworks
• SOC 2 compliance
• ISO 27001 compliance