Design, develop, enhance and monitor security systems to protect the company's computer networks and end-point devices from cyber-attacks, and help set and maintain security policies and standards.
General Statement of Duties: The Information Security Analyst will participate in computing defense by assisting in planning and implementing security measures to protect computer systems, networks and data. Prevent data loss and service interruptions by researching new technologies that will effectively protect a network, and stay up to date on the latest intelligence, including those consistent with New York State Department of Financial Services (NYS-Client) and Federal Deposit Insurance Corporation (FDIC) cybersecurity and information security guidelines, and hackers' methodologies, in order to anticipate security breaches.
Supervision Received: VP/Information Security
Major Duties and Responsibilities:
- Develop Information Security Plans and Policies.
- Assist in planning and helping carry out the company's information security strategy.
- Assist in the enhancement/development of security standards and best practices for the organization.
- Recommend security enhancements to management as needed.
- Assist in the enhancement/development of strategies to respond to and recover from a security breach.
- Assist in educating employees on information security through training and building awareness.
- Enhance/Develop Information Security Controls
- Review all information security controls in place and make recommendations for enhancements and/or the implementation of new controls consistent with NYS Client and FFIEC regulatory guidelines.
- Monitor controls via alerting/reporting on a daily basis, log activity and maintain audit artifacts, as applicable.
- Implement Information Security Protections
- Install and use software such as Data Loss Prevention, Web Security, end-point protection, and data encryption programs based on procedural guidelines.
- Test for Vulnerabilities and Assess Device Configurations
- Conduct periodic vulnerability scans of network infrastructure and end-point devices.
- Assist in the assessment of infrastructure device hardening configurations.
- Follow-up and document all vulnerability remediation activity from identification to resolution.
- Assist in coordinating penetration testing with 3rd parties to identify any weaknesses in the network that might be exploited by a malicious party.
- Coordinate external vulnerability assessments to identify and prioritize vulnerabilities in network infrastructure, end-points and applications.
- Monitor and Investigate Security Breaches
- Interface with the Security Operations Center (SOC) to respond to alerts and monitor networks and systems for security breaches or intrusions.
- Coordinate the installation of software (i.e. HIDS agents), as needed, to help enhance the monitoring of devices on the company's network.
- Respond to internal security alerts from various systems and coordinate all response and remediation activity, as applicable.
- Assist in the investigation of security breaches, coordinate incident response activities to minimize impact.
- Assist in technical and forensic investigations, as needed.
- Provide input in preparing reports of security event findings to be reported to management.
- Non-Essential Responsibilities:
- Perform other related functions as required by manager.