Senior Information Security Analyst (Assistant Vice President)

Senior Information Security AnalystThis is a full-time position for a Senior Information Security Analyst within the Information Security team that participates in all aspects of information security. The Security Analyst shall act as a risk manager with the responsibility for identifying, acting on and escalating risks and is held strictly accountable for the failure to discharge their information security duties. The employee shall also be responsible for demonstrating risk awareness by following all security policies, procedures and internal controls in the daily routine.

Ability to make decisions and influence decisions in the areas of risk management and compliance are key to the role. The Security Analyst will ensure that policy and compliance documentation, requirements and controls are properly and timely identified, mapped, tracked, reviewed, and reported for the organization to increase security posture. In this role he will work closely with other members of the Security Team and IT Infrastructure Teams to manage and support security administration tasks and security projects.Responsibilities:Experience leading risk assessments, audits, policy, governance, and/or reporting, preferably in a financial institutionAssist with mapping controls to policies, procedures, and processes and testing of those controls to ensure adequate coverageEstablish and maintain security manualsWork with control owners in the remediation and tracking of deficienciesAssist with increasing the maturity of the Information Security program, strategy and processProvide security services in identifying, assessing, managing, and tracking remediation of information security risks related to IT infrastructure, applications, platforms and suppliers and drive explicit requirements and timelines in all environmentsProvide update to the CISO and/or CRO on progress of remediation effortsQualys: scanning for vulnerabilities and baseline configuration compliance, monitoring new and existing vulnerabilities and working with IT and users to remediate, daily, weekly, monthly reporting, reviewing results of reports and presenting to IT to remediate issues, network monitoring, monitoring assets connected to the network scanning for assets and reconciling with IT asset inventory, daily monitoring of system events for malicious activityTufin: firewall rule review and approvalAlienVault: SIEM – system event monitoring and analysis with follow up if issue is detectedTipping Point: IPS – monitoring network for signs of malicious activity or exploitationTrellix EPO + TMS: daily monitoring of Data Loss Prevention toolsManage phishing campaigns, create email templates, perform testing, analyze results, and write reportSpirion: create scans to monitor files containing PII and ensure they are destroyed in accordance with data retention policyPrivileged Access Management (PAM) and reportingChair weekly IT meeting to discuss vulnerabilities, patching, and alarms generated by IS toolsThreat Intelligence – monitor Qualys Threat Protection Feed and CISA emails for relevant information to protect the networkWork with vendors for troubleshooting and maintenance of IS toolsEducation and Experience Requirements:5+ years managing information security governance, risk, and complianceBachelor's degree in information technology or security discipline (e.g.

cybersecurity) or related worked experienceIndustry recognized security certifications are a plus but not required (e.g. CISSP, CISA, CISM, CEH, etc.)Skills and Knowledge:Demonstrated knowledge of industry authoritative sources such as NIST Cybersecurity Framework, SOC2 and ISO standards, FFIEC framework and NYDFS-Part 500 regulationsWorking with GRC applications and toolsets, such as RSA ArcherProficient in Microsoft OfficeExcellent written and verbal communication and presentation skills; good command of spoken and written EnglishInterpersonal and collaborative skills; and the ability to communicate information risk-related concepts to technical as well as nontechnical audiencesSkilled at planning, tracking plans, working cross department to review risks, controls and processes, and gathering and organizing documentation and test resultsSelf-directed, works with minimal guidance, and recognizes when guidance neededAbility to cope with pressure and responsibility