AVP Senior Information Security Analyst

Summary:

This is a full-time position for a Senior Information Security Analyst (“Security Analyst”) within the

Information Security team that participates in all aspects of information security.

The Security Analyst shall act as a risk manager with the responsibility for identifying, acting on and

escalating risks and is held strictly accountable for the failure to discharge their information security

duties. The employee shall also be responsible for demonstrating risk awareness by following all security

policies, procedures and internal controls in the daily routine.

Ability to make decisions and influence decisions in the areas of risk management and compliance are

key to the role. The Security Analyst will ensure that policy and compliance documentation, requirements

and controls are properly and timely identified, mapped, tracked, reviewed, and reported for the

organization to increase security posture.

In this role he will work closely with other members of the Security Team and IT Infrastructure Teams to

manage and support security administration tasks and security projects.

Requirements

Responsibilities:

SOC Operations (to include SIEM, SOAR, EDR, Threat Intelligence)- Perform initial triage of security

alerts and escalate real alerts; make recommendations to refine SIEM correlation rules and gather

intelligence from open source and vendor threat sources.

Root Cause Investigations & Incident Response Playbooks - Includes maintaining and updating the

IR Handbook using lessons learned from past incidents and assisting with documenting root cause

reports and tracking post-incident action items.

Log Collection & Forensic Analysis - Verify log capture across critical security tools and maintain

logging infrastructure dashboard and alert on missing logs.

Security Architecture Strategies- Maintain inventory of security tools and document security control

coverage across the environment.

DLP & Insider Threat Monitoring - Monitor DLP alert queues and escalate violations to management;

assist in analyzing data movement patterns for potential insider threats.

Penetration Testing & Tabletop Exercises- Document results from pen tests and track remediation

progress; coordinate logistics for tabletop exercises (scheduling, note-taking).

Vulnerability Management & Patching SLAs- Track patching compliance and generate weekly

reports; assist in validating vulnerability remediation efforts.

Attack Surface Monitoring & Threat Modeling - Monitor the asset inventory for continuous updates

and assist in threat modeling sessions by documenting identified risks. Baseline Configuration Compliance - Track deviations from approved baselines and escalate

compliance violations; maintain a database of baseline configurations for quick reference.

Asset Management for Security Tools, Hardware, Software- Maintain asset tracking logs for

security tools and their deployment status; assist in decommissioning outdated security software.

Audit Support / Remediation Efforts- support internal audit activities, assess current cybersecurity

controls in place, and drive remediation efforts for identified findings.

Risk Reporting- identifying, tracking, analyzing, and reporting key risk indicators (KRIs). Help provide

actionable insights to enhance our cybersecurity risk management and informed decision-making.

Education and Experience Requirements:

At least 3 years managing information security governance, risk, and compliance.

Bachelor’s degree in information technology or security discipline (e.g. cybersecurity) or related

work experience.

Industry recognized security certifications are a plus but not required (e.g. CISSP, CISA, CISM, CEH,

etc.)

Skills and Knowledge:

Demonstrated knowledge of industry authoritative sources such as NIST Cybersecurity

Framework, SOC2 and ISO standards, FFIEC framework and NYDFS-Part 500 regulations.

Experience with Splunk Cloud, Qualys, Spirion, Trellix, PAM, Tufin or similar information security tool is

preferred.

Excellent written and verbal communication and presentation skills; Good command of spoken and

written English.

Interpersonal and collaborative skills; and the ability to communicate information risk-related

concepts to technical as well as nontechnical audiences .

Skilled at planning, tracking plans, working cross department to review risks, controls and processes,

and gathering and organizing documentation and test results.

Self-directed, works with minimal guidance, and recognizes when guidance needed Ability to cope

with pressure and responsibility.

This job description is not limited to the responsibilities listed and the incumbent may be requested to perform

other relevant duties as required by business needs.