Information Security Compliance Analyst

Sungrow is a provider of renewable energy solutions, including photovoltaic inverters and energy storage systems. The Information Security Compliance Analyst II will support cybersecurity governance, risk, and compliance activities by implementing and validating security controls, managing evidence, supporting assessments, tracking remediation, and maintaining alignment with cybersecurity frameworks and regulatory requirements.

Responsibilities:

• Support the development, implementation, documentation, and maintenance of cybersecurity controls across enterprise and product environments
• Work directly with control owners to translate cybersecurity requirements into practical operational and technical controls
• Document control objectives, ownership, scope, frequency, procedures, dependencies, and evidence requirements
• Review existing security practices against established requirements and identify potential control deficiencies
• Validate that controls have been implemented and are operating in accordance with documented requirements
• Coordinate with responsible teams to address identified deficiencies and track remediation through closure
• Assist in identifying appropriate compensating controls where primary controls cannot reasonably be implemented
• Support documentation and tracking of control exceptions and risk-acceptance decisions
• Collect, organize, review, and maintain evidence demonstrating the implementation and operation of cybersecurity controls
• Evaluate whether submitted evidence is sufficient to substantiate control performance and effectiveness
• Maintain traceability between requirements, policies, controls, control owners, testing activities, and supporting evidence
• Identify incomplete, outdated, inconsistent, or insufficient evidence and coordinate resolution with responsible stakeholders
• Establish repeatable evidence-collection processes and evidence requirements
• Maintain organized evidence repositories supporting audits, assessments, customer reviews, and internal compliance activities
• Support periodic control testing and validation activities
• Maintain documentation in accordance with applicable confidentiality, integrity, retention, and chain-of-custody requirements
• Assist in drafting, reviewing, maintaining, and implementing information security policies, standards, procedures, and supporting governance documentation
• Work with the GRC Manager and subject-matter experts to translate cybersecurity requirements into organizational policies and controls
• Support policy review, approval, publication, acknowledgement, and periodic review processes
• Monitor adherence to established cybersecurity policies and standards
• Assist business and technical teams in understanding and implementing policy requirements
• Document policy exceptions and support associated review, remediation, and risk-acceptance processes
• Track policy and standards lifecycle requirements and associated compliance activities
• Support implementation and maintenance of cybersecurity requirements associated with applicable frameworks, standards, and regulatory expectations, including: NIST Cybersecurity Framework (CSF); NIST SP 800-series guidance; ISO/IEC 27001 and ISO/IEC 27002; SOC 2; NERC CIP, where applicable; Other cybersecurity and critical-infrastructure requirements applicable to Sungrow's business, products, and customers
• Research cybersecurity requirements and assist in determining their applicability to Sungrow environments
• Map organizational controls to applicable framework, regulatory, contractual, and customer requirements
• Support cybersecurity gap assessments and compliance-readiness reviews
• Assist in developing and tracking remediation plans for identified gaps
• Maintain awareness of evolving cybersecurity requirements affecting the U.S. energy and critical-infrastructure sectors
• Support cybersecurity compliance activities across both enterprise IT and product environments
• Coordinate with Product Security, Engineering, Information Technology, Security Operations, and other stakeholders to document and substantiate applicable controls
• Support tracking of cybersecurity requirements across systems, products, business units, and organizational functions
• Assist in establishing consistent control and evidence practices across enterprise and product security programs
• Maintain records of compliance status, identified gaps, exceptions, remediation activities, and supporting evidence
• Support internal and external cybersecurity assessments, audits, customer reviews, and certification activities
• Coordinate evidence requests with control owners and responsible stakeholders
• Review evidence for completeness, accuracy, relevance, and traceability prior to submission
• Prepare and organize supporting documentation for assessments
• Document findings and track corrective actions through remediation and validation
• Assist control owners in understanding assessment requirements and preparing for evidence reviews
• Support continuous audit readiness rather than relying solely on point-in-time audit preparation
• Support completion of customer, partner, and third-party cybersecurity questionnaires and due-diligence requests
• Research questions and coordinate responses with appropriate internal subject-matter experts
• Ensure statements regarding Sungrow's cybersecurity practices are supported by documented controls and available evidence
• Maintain reusable evidence and validated responses to improve consistency and efficiency
• Escalate questions involving material regulatory, contractual, or cybersecurity representations to Information Security leadership and Legal as appropriate
• Support third-party cybersecurity assessments and associated compliance documentation
• Maintain compliance trackers, control records, evidence inventories, findings, exceptions, and remediation activities
• Monitor evidence currency, remediation deadlines, policy reviews, control status, and other compliance obligations
• Assist in developing cybersecurity compliance metrics, dashboards, and key control indicators
• Prepare clear written summaries of findings, risks, compliance gaps, and remediation status
• Provide accurate compliance information to the Information Security GRC Manager for leadership and governance reporting
• Escalate material, overdue, or unresolved compliance issues through established governance processes
• Build effective working relationships with technical and nontechnical stakeholders throughout the organization
• Communicate cybersecurity requirements clearly and professionally
• Facilitate control-design, evidence-collection, and compliance-review discussions
• Help control owners understand both the requirement and the underlying security objective
• Work collaboratively to develop sustainable controls that satisfy security requirements without creating unnecessary operational burden
• Maintain appropriate independence when evaluating whether controls and evidence satisfy established requirements
• Support continued development and maturation of Sungrow's U.S. cybersecurity governance and compliance program
• Develop repeatable templates, procedures, evidence standards, control documentation, and compliance workflows
• Identify opportunities to automate evidence collection, control monitoring, and compliance reporting
• Support implementation and administration of GRC and compliance-management technologies
• Research evolving cybersecurity frameworks, regulatory requirements, and industry practices
• Continuously develop expertise in cybersecurity governance, risk, compliance, product security, and critical-infrastructure security

Requirements:

• 3+ years of professional experience in cybersecurity, information security, information technology, information assurance, intelligence, security operations, risk management, compliance, audit, or another security-related discipline
• Experience working within structured security, technical, regulatory, military, government, critical-infrastructure, or other high-accountability environments
• Experience collecting, analyzing, documenting, or reporting technical, operational, or security-related evidence
• Experience implementing, validating, monitoring, assessing, or operating security controls or security configurations
• Working knowledge of cybersecurity risk and fundamental security-control concepts
• Familiarity with cybersecurity policies, standards, procedures, or formal security requirements
• Foundational knowledge of one or more cybersecurity frameworks or standards such as NIST CSF, NIST SP 800-series guidance, ISO/IEC 27001, SOC 2, NERC CIP, or comparable frameworks
• Strong analytical, technical-writing, and documentation skills
• Demonstrated attention to detail and ability to maintain accurate and defensible records
• Ability to communicate effectively with both technical and nontechnical stakeholders
• Ability to independently research unfamiliar cybersecurity requirements and translate findings into practical recommendations
• Ability to manage multiple priorities and follow assigned compliance activities through completion
• Up to 25%, based on business requirements
• Full-time position
• Remote with on-site work as required
• No visa sponsorship
• Bachelor's degree in Cybersecurity, Information Security, Information Technology, Computer Science, or a related discipline. Equivalent military, government, technical, or professional experience may be considered
• Experience supporting cybersecurity evidence collection, control validation, risk assessments, compliance assessments, or audit activities
• Experience working in military, government, defense, energy, critical infrastructure, manufacturing, industrial technology, or similarly controlled environments
• Experience operating under formal security protocols, access-control requirements, information-handling procedures, or chain-of-custody requirements
• Experience preparing formal technical, security, risk, or compliance reports
• Familiarity with enterprise security technologies, networking, identity and access management, vulnerability management, security monitoring, or incident response concepts
• Exposure to customer security questionnaires, third-party risk assessments, audit preparation, or compliance activities
• Relevant cybersecurity certifications such as CompTIA Security+, CySA+, Network+, CISA, CRISC, ISO/IEC 27001 certifications, or comparable credentials
• Demonstrated interest in developing advanced expertise in cybersecurity governance, risk, compliance, and critical-infrastructure security