Information Assurance Analyst

Information Security Analyst Contractor

Responsibilities will include:

• Work within a Governance Risk and Compliance (GRC) system to add and update security and risk data, records, and documentation.
• Partnering with business stakeholders to develop and maintain Information System Security Plans (SSP).
• Participate in Information Security and Privacy efforts across all business areas and supplier engagements to ensure the appropriate security controls are in place.
• Facilitating security information gathering meetings to collect necessary information for completion of SSPs, risk assessments, and other security work products.
• Represent the Information Security Office in PMO projects to ensure specific projects and initiatives have appropriate ISO representation.
• Responsible for partnering across teams, collaborating with business units to understand business challenges, developing necessary tailored control options, facilitating compliance requirements, and providing timely and clear communications to stakeholders.
• Assists with the development and maintenance of information security standards and processes, including conducting occasional research of best practices from reputable sources.
• Assists with controls documentation, including information system diagramming, completing risk assessment templates, and drafting security documentation as needed.
• Assist in reviewing contracts, agreements, and other vendor documentation to ensure adequate information security protections are in place.

Qualified candidates must possess:

• At least (3) years of demonstrated experience in Information Security concepts related to governance, risk, and compliance.
• Extensive knowledge of the principles and practices of information security.
• Familiarity or experience working with a security framework, such as NIST, ISO 27001, etc.
• Extensive knowledge of the principles and methods applied to information technology infrastructure planning, implementation, and management.
• Excellent written and verbal communication skills.
• Ability to organize tasks, set priorities, meet established deadlines, and follow up assignments with minimum direction.
• Superior organizational skills and attention to detail.
• Ability to continually prioritize and change or adapt to ambiguous situations.
• Ability to interpret and understand security documentation, including flow diagrams and process maps.
• Ability to understand general contract terms and conditions.
• Ability to create basic diagrams, flowcharts, and spreadsheets using COTS desktop software.
• Ability to write clearly and concisely to various audiences.

Preferred experience includes:

• Bachelor's degree in Computer Science or Information Systems or equivalent. Certified Information Systems Auditor (CISA), Certified Information Systems Security Professional (CISSP), or equivalent information security certification is preferred.
• Previous experience working in the financial services industry is preferred.
• Knowledge of controls related to cloud security and application security.
• Knowledge of Information Security regulatory compliance (e.g., GLBA, GDPR, PCI, etc.).
• Knowledge of various privacy regulations (e.g., GRPR, CCPA, VCDPA, etc.).
• Experience drafting Information Security and Privacy policies, standards, and procedures.