Security Compliance Analyst
The Security Compliance Analyst is a key individual contributor to the team. Works under the oversight and direction of the SVP/Information Security Officer. Responsible for supporting the execution of various security controls following the Bank’s security, cybersecurity, and incident response programs. The Security Compliance Analyst Jr. executes a variety of tasks to achieve this overarching objective, ranging from; analyzing security reports, performing system and application reviews; testing for adherence to system hardening guidelines; analyzing vulnerability scans recommending actions to proactively mitigate threats; among others. The Security Compliance Analyst Jr. contributes to ensuring the Bank stays compliant with GLBA, Privacy, FFIEC and other applicable regulations. This role requires interaction with all members of the Risk Management team and cross-functional collaboration with IT Operations and other areas of the bank. The analyst may occasionally interact with external stakeholders, as part of audits or consulting engagements.
Essential Duties and Responsibilities: (Other duties and/or tasks might be assigned on a needed basis)
§ Information Security and Cybersecurity Program (ISP) – Support security and risk management internal controls and business processes to ensure compliance with the Bank’s Information Security, Cybersecurity, and Incident Response programs.
§ Security Reviews, Monitoring, and Testing – Assist with the ongoing monitoring of business applications and general computing controls established to protect information systems and assets (e.g., infrastructure, network, applications, hardware). These duties may include performing periodic reviews and tests of various security controls to assess effectiveness and adherence to Bank policy and security standards.
§ Security Risk Assessments and External Engagements – Actively participate with the team in threat hunting exercises, incident tabletop exercises, disaster recovery exercises, network penetration tests and other relevant external engagements. Provide support to fulfill information requests for security audits and consulting engagements.
§ Management Reporting Support – Assists the team with data gathering, aggregation and reporting of key performance and risk indicators to facilitate the overall monitoring of cybersecurity posture. Also assist the SVP ISO with preparation of periodic security briefings and presentations for Management and Board-Level Committees.
§ Access Management, Application Controls and FDICIA ITGC Compliance – Support the team in maintaining documentation for user access profiles for critical applications. Assist with the data staging, analysis, and preparation of user entitlement review for applications and systems. Support with periodic monitoring of administrator and user activity for critical applications and system. Escalate to Manager, instances of non-compliance, or suspected anomalies. Assist with updating logs to maintain key performance indicators for the area.
§ Other Tasks and Special Projects – Assist with special projects to improve the security posture of the Bank. Strategic initiatives or other special tasks may be assigned by the Supervisor or the Division head from time to time.