Senior Information Security Analyst

General Statement of Job:

The Senior Information Security Analyst is a senior individual contributor responsible for advancing SIS's information security program and for leading the company's effort to achieve and maintain ISO 27001 certification. This individual owns the day-to-day operation of the Information Security Management System (ISMS)—risk assessment, control implementation, policy development, internal audit readiness, and evidence collection—and serves as the primary respondent to client cyber security surveys, questionnaires, and third-party assessments. The role is measured by steady, incremental progress against SIS's published security objectives across the cloud, identity, endpoint, and network environment, as well as the physical security technologies deployed at SIS offices and at client sites monitored by the Fusion Center. SIS operates a predominantly Apple environment (approximately 90% macOS) supporting a 24/7 Global Security Operations Center. The Senior Information Security Analyst works within an ITIL-based operational framework and reports directly to the Director of Technology.

This is an individual contributor role without direct reports. The Senior Information Security Analyst operates as a peer to the Senior Manager of IT Infrastructure and Senior Manager of Applications and works closely with the IT Infrastructure, Applications, Help Desk, and Fusion Center teams to implement and validate security controls across the enterprise. The position carries functional authority for security requirements and compliance obligations, influencing technical direction through subject matter expertise rather than direct supervision.

Essential Job Functions:

• Design and maintain security reference architectures and technical security standards across the cloud, identity, endpoint, network, application, and physical security domains, and review proposed designs and infrastructure changes against them (15%)

• Administer, tune, and monitor security tooling in partnership with the Senior Cloud Administrator, including endpoint detection and response (SentinelOne), vulnerability management, email security, data protection, and a Security Information and Event Management (SIEM) solution, ensuring alerts are actionable and triaged (10%)

• Own vulnerability management and remediation across endpoints, infrastructure, and cloud services, including patch currency, device encryption, configuration hardening, and periodic least-privilege access reviews (10%)

• Build and automate security operations through scripting and platform integration, including continuous control monitoring, automated evidence collection, access review workflows, and alert enrichment, reducing reliance on manual, point-in-time compliance effort (10%)

• Support security incident response, including investigation, containment coordination, documentation, root cause analysis, and post-incident reporting, working closely with IT Infrastructure and Fusion Center leadership (5%)

• Conduct security reviews of enterprise business applications, including Salesforce, Sage Intacct, the enterprise workforce management platform, and internally developed applications, covering role and permission models, segregation of duties, data sharing and export controls, API and integration credentials, audit logging, and data retention (5%)

• Establish secure development and application security requirements for custom and client-facing applications, including secure coding standards, dependency and vulnerability scanning, penetration testing cadence, and remediation tracking with internal development and vendor teams (5%)

• Drive onboarding of enterprise applications to centralized identity, including Single Sign-On and automated provisioning, and conduct periodic application-level access reviews and offboarding validation (2%)

• Contribute information security and technical expertise to the standards and longer-term strategy for physical security technologies in use at SIS offices and at client sites monitored by the Fusion Center, including video management and camera platforms, access control and badge systems, and emerging AI-based detection and video analytics capabilities, in partnership with the Director of Technology, Fusion Center leadership, and other system owners (5%)

• Ensure physical security systems are deployed and maintained in line with information security requirements, including network segmentation, device hardening, credential and certificate management, firmware currency, centralized logging, and data retention and privacy obligations (5%)

• Perform security review of new technologies, vendors, and contracts, including third-party risk assessment and review of security exhibits and data protection terms (3%)

• Lead SIS's ISO 27001 certification effort end to end, including scoping and the Statement of Applicability, gap assessment against Annex A controls, hands-on implementation and configuration of the technical controls, internal audit, remediation of findings, and successful completion of the Stage 1 and Stage 2 certification audits (TEMPORARY, FIRST ~8 MONTHS)

• Operate and mature the Information Security Management System on an ongoing basis, maintaining the risk register and risk treatment plans, coordinating management review, tracking corrective actions, and preparing the organization for annual surveillance audits and recertification (5%)

• Serve as the primary respondent for client cyber security surveys, security questionnaires, and third-party risk assessments (for example, CAIQ, SIG, and custom client formats), maintaining a curated answer library and evidence repository, and converting identified gaps and client commitments into tracked remediation items driven to closure with the responsible technical owners (5%)

• Define, measure, and report on SIS's security objectives and key security metrics, delivering visible incremental improvement quarter over quarter and reporting progress to technology leadership and key stakeholders (5%)

• Develop and maintain information security policies, standards, procedures, and control documentation, and deliver the company's security awareness and role-based training program (3%)

• Maintain accurate documentation and audit evidence supporting compliance objectives such as ISO 27001, SOC 2, and client contractual security requirements (2%)

• Provide senior-level security guidance and escalation support to the IT, Help Desk, and business teams, and mentor junior administrators and coordinators (5%)

• Perform other related duties as required