Information Security Administrator

Role

The Information Security Administrator (ISA) is a member of the Information Technology department and reports to the Information Security Manager (ISM). The ISA is responsible for the administration, monitoring, and continuous improvement of the credit union's cybersecurity technologies and security controls. This role designs, implements, and maintains solutions that protect systems, networks, applications, and information assets from internal and external threats. The ISA serves as a technical security resource supporting security operations, incident response, vulnerability management, security testing, compliance activities, and the ongoing enhancement of the organization's overall security posture.

Major Duties and Responsibilities

Information Security Operations:

• Protect electronic information and infrastructure from external and internal threats, maintain compliance with statutory and regulatory requirements regarding information access, security and privacy.
• Install, configure, administer, automate, monitor, troubleshoot, and optimize security technologies including firewalls, IDS/IPS, SIEM, DLP, CASB, endpoint protection, email security, secure remote access, and other security infrastructure systems.
• Design, implement, test, and maintain security controls, configurations, automations, integrations, and architecture improvements to strengthen the credit union's security posture and support operational requirements.
• Develop and maintain scripts, automations, workflows, and integrations to improve security operations, monitoring, reporting, and response capabilities.
• Participate in the review and selection process for new information security solutions.
• Analyze security events, logs, alerts, and network activity to identify threats, suspicious behavior, and indicators of compromise. Investigate, escalate, contain, and resolve security incidents, participate in forensic analysis, and support recovery activities following security events.
• Perform vulnerability assessments, patch validation, and remediation activities. Analyze vulnerabilities for risk and work with infrastructure, application, and operational teams to implement corrective actions.
• Conduct risk and compliance reviews and coordinate third-party assessments and audits.
• Provide security-related support to users and resolve any security-related issues they encounter.
• Administer, maintain, monitor, troubleshoot, and support electronic and physical security systems, including video surveillance, access control, alarm, environmental monitoring, and other security monitoring technologies.
• Participate as a technical lead or advisor on information security initiatives and other ad-hoc projects as assigned.
• Maintain detailed documentation of all security systems and procedures.
• Participate in the change and configuration management process, ensuring security-related changes are properly evaluated, documented, tested, and implemented in accordance with established procedures.
• Produce reports and presentations that outline findings, explain risk positions, and recommend improvements.
• Maintain records of security incidents, investigations, and outcomes.
• Conduct technical security assessments, control validation, and security testing to identify weaknesses and verify the effectiveness of implemented controls.
• Other duties as assigned by management
• Follows policy and procedures related to Bank Secrecy Act (BSA), Anti-Money Laundering (AML), Customer Identification Program (CIP) and Customer Due Diligence (CDD) daily to ensure compliance with current regulations. Follows policy and procedures related to SARs by reporting suspicious activity to the Compliance department. Responsible for filling out an incident report for detected computer intrusion of Credit Union computer systems per Bank Secrecy Act. Completes mandatory BSA/AML annual training via online web course.

Programs, Policies and Plans:

• Participate in Business Continuity (BCP), Disaster Recovery (DR), and Incident Response (IR) exercises, tabletop scenarios, testing, and recovery activities. Assist with the execution, validation, documentation, and continuous improvement of resilience and recovery capabilities.
• Support the development, maintenance, and implementation of Cybersecurity and Information Security policies, standards, procedures, and programs that comply with applicable laws, regulations, and industry best practices.

Collaboration:

• Provide security guidance and input to technical reviews of proposed projects, services and vendors.
• Provide security-related support to the IT department and other business units as needed.
• Work with application and operational teams to encourage a security mindset throughout product development processes from concept to testing and implementation.
• Coordinate with security vendors, service providers, and technology partners to support system administration, incident response, troubleshooting, upgrades, implementations, maintenance activities, and remediation efforts.

Training and Awareness:

• Contribute to the development and delivery of security awareness training for employees.
• Maintain awareness of changing and emerging information security and cyber security threats and provide subject matter expertise to management on a broad range of information security topics and standards.