Senior Information Security Analyst

This is a fully remote position, open to applicants in United States.

📋 Description

• Oversee GRC platforms to identify failing or at-risk technical controls in accordance with SOC 2, HIPAA, and NIST CSF 2.0 standards.

• Assess controls to identify remediation requirements and priorities, generate tickets, and monitor remediation efforts until completion.

• Record exceptions, accepted risks, and instances of false positives.

• Track vulnerability and cloud security alerts, triage findings, assign severity levels, and guide the remediation process.

• Develop and manage vulnerability management processes, including KPIs, metrics, backlog analysis, and trend reporting.

• Validate workstation configurations against established CIS Benchmarks and coordinate necessary remediation actions.

• Act as the first-line responder to calls and escalations from the managed security operations provider.

• Engage in incident investigations, including evidence collection and preservation, containment coordination, and conducting post-incident reviews.

• Maintain the Incident Response Plan and lead tabletop exercises.

• Organize annual external penetration tests and ensure the remediation of identified vulnerabilities.

• Assist with third-party risk management, technical questionnaires, customer RFPs, and critical vendor security investigations.

• Support SOC 2 and customer audit evidence collection and preparation activities.

• Monitor for unauthorized usage of SaaS and AI tools, investigate flagged activities, fine-tune monitoring alerts, and escalate significant cases to the CISO.

⛳️ Requirements

• Over 7 years of experience in information security, security operations, vulnerability management, GRC, or a related field.

• Comprehensive information technology knowledge in infrastructure/operations or application development.

• Proven experience in security incident response, including evidence collection and preservation, along with collaboration with a managed security operations or managed detection and response provider.

• Practical experience with a GRC/compliance-automation platform and vulnerability scanning tools.

• Familiarity with SOC 2, the HIPAA Security Rule, NIST CSF 2.0, and CIS Benchmarks.

• Understanding of public cloud security configurations and a commonly used enterprise productivity suite.

• Capability to interpret application dependency manifests, infrastructure-as-code, and cloud configurations.

• Experience in designing and implementing repeatable, scalable processes.

• Ability to communicate technical risks in business terms to leadership, legal teams, and non-security technology groups.

• Willingness to participate in a shared on-call rotation for after-hours security escalations.

• Flexible working hours and schedule.

• Some travel may be necessary.

• A master's or bachelor's degree in Computer Science, MIS, or a related technical field is preferred.

• Experience in healthcare or other regulated industries is preferred.

• CISSP certification is a valuable asset.

🏝️ Benefits

• Full-time employment.

• Remote work opportunities within the United States.

• Shared on-call rotation compensation included with role participation (no separate amount specified).

• Reasonable accommodations available for individuals with disabilities.

• Commitment to equal employment opportunity.