Senior Security Analyst Exton, Pennsylvania, United States

TheSeniorSecurity Analystis responsible foradvancingEnergage'sinformation security, privacy, and compliance programs by implementing and continuously improving technical controls, governance processes, and risk management practices. This role serves as a senior technical and operational resource responsible for protecting company systems, customer data, and business operations while enabling the organization's continued growth. The position partners closely with Engineering, Product, IT, Legal, HR, and business leaders to embed security and privacy into company operations, ensuring compliance with regulatory requirements and industry best practices whilemaintaininga practical, business-focused approach to risk management. The position reports to the Director of Information Security& Data Privacy. Accountability & Impact: In this role, you’ll... Supportthe integration of security throughout the Secure Software Development Lifecycle (SSDLC). Partner with Engineering teams to implement secure coding standards, code scanning, dependency management, and application security testing. Perform application security reviews, threat modeling, and architecture assessments. Evaluatenew technologiesand software solutions for security risks before implementation. Support vulnerability remediation efforts within internally developed applications. Continuouslymonitorthe organization's security posture using security monitoring platforms, endpoint protection, cloud security tools, SIEM, and vulnerability management solutions. Investigate security alerts, suspicious activity, and potential incidents and escape or coordinate response activities asappropriate. Implement andmaintaincloud security controls across SaaS and cloud infrastructure. Manage encryption, key management, secure storage, identity management, and Data Loss Prevention (DLP) technologies. Evaluate and recommend improvements to network, endpoint, identity, and cloud security architecture. Governance, Risk & Compliance (GRC) Executeandcoordinateexternal security audits and assurance activities, including ISO 27001 certification and surveillance audits, SOC 2 examinations, customer security assessments, and other applicable compliance reviews. Support organizational alignment with security frameworks and standards, including the NIST Cybersecurity Framework (NIST CSF) and other applicable industry frameworks. Serve as the primary Information Security point of contact for external auditors and customer security questionnaires. Own evidence collection, audit preparation, remediation tracking, and continuous compliance activities. Maintain and mature the organization's Integrated Management System (IMS). Develop,maintain, and improve security policies, standards, procedures, andsupportingdocumentation. Perform enterprise security risk assessments andmaintainthe organizational risk register. Conduct comprehensive third-party/vendor security assessments and ongoing vendor risk monitoring. Track remediation activities and ensuretimelyresolution of audit findings andidentifiedrisks. Data Privacy & Governance Work directly with Product and Engineering to implement application and cloud securityand privacyrequirements and addressidentifiedrisks. Conduct Data Protection Impact Assessments (DPIAs) and privacy risk assessments in collaboration with Legal andappropriate businessstakeholders. Coordinateenterprise data mapping and data flow documentation initiatives. Maintaindata retention, deletion, and classification standards in collaboration with Legal and applicable data owners. Support organizational compliance efforts related to applicable privacy and data protection requirements, including GDPR, CCPA/CPRA, and other relevant regulations. Support Legal, leadership, andappropriate stakeholdersin privacy incident assessment, investigation, and regulatory notification activities. Maintain privacy-related policies, procedures, notices, andsupportingdocumentation in collaboration with Legal andappropriate stakeholders. Vulnerability & Threat Management Administer vulnerability management platforms and coordinate enterprise vulnerability scanning. Analyze vulnerability intelligence and emerging threats. Prioritize remediation efforts based on business risk. Coordinate with infrastructure, engineering, and application teams to ensuretimelyremediation. Track remediation metrics and provide regular reporting to leadership. Security Architecture & Technical Risk Participate in architecture reviews fornew technologies, cloud services, integrations, and business initiatives. Identifysecurity risks during project planning and recommendappropriate mitigations. Review identity, authentication, authorization, and access control designs. Evaluate technical solutions against security standards and organizational risk tolerance. Support Zero Trust, Identity and Access Management (IAM), and security architecture initiatives. Security Operations & Incident Response Participate in and support the organization's incident response program. Investigate security events and coordinate incident response activities, including investigation, containment, remediation, and recovery. Assistwith the developmentand maintenance ofincident response procedures and playbooks. Conduct andfacilitateroot cause analysis and post-incident reviews. Recommend process and technology improvements based on lessons learned. Assistwith disaster recovery and business continuity planning from a security perspective. Security Awareness & Leadership Promote a culture of security awareness throughout the organization. Develop and deliver security awareness training. Mentor junior security analysts andprovidetechnical guidance. Assistwithstrategic security improvement initiatives. Stay current on emerging threats, technologies, regulatory developments, and industry best practices. Represent Information Security on cross-functional projects and steering committees. Cross-Functional Collaboration Work directly with Product and Engineering to implement application and cloud security requirements and addressidentifiedrisks. Collaborate with third-party vendors to ensure adherence to Energage security requirements. Support customer security assessments and due diligence activities. Providesecurity guidance during the procurement and implementation ofnew technologies. What You Bring to the Role: Bachelor's degree in Information Security, Computer Science, Information Technology, or equivalent professional experience. 3+ years of progressive experience in Information Security, Cybersecurity, Security Engineering, ora relateddiscipline. Experience supporting security and compliance programs involving ISO 2701, SOC 2, NIST CSF, or similar standards and frameworks. Experience performing security risk assessments and vulnerability management. Working knowledge of cloud security principles and technologies in environments such as AWS, Azure, or Google Cloud. Experience with SIEM, endpoint security, vulnerability management, identity management, and security monitoring tools. Strong understanding of networking, authentication, encryption, access control, and security architecture principles. Experience supporting privacy compliance initiatives involving regulations such as GDPR and CCPA/CPRA. Strong written and verbal communication skills, including the ability to communicate security risks and recommendations to technical and non-technical stakeholders. Nice to haves: Certified Information Systems Security Professional (CISSP) Certified Information Security Manager (CISM) Certified Cloud Security Professional (CCSP) Global Information Assurance Certification (GIAC) Certified Information Privacy Professional (CIPP) CompTIA Security+ ISO 27001 Lead Implementer or Lead Auditor Equivalent or comparable industry-recognized certifications will also be considered. Compensation and Benefits: The base pay range for this role is $77,000 - $82,000 . The base pay range is dependent on factors including, but not limited to, experience, skills, qualifications, relevant education, certifications, seniority, and location. The range listed is just one component of the total compensation package for employees. This role is also bonus eligible. In addition to base pay, our total rewards package includes: PTO policy includes company holidays, sick time, vacation time, and floating holidays Remote Company pays a portion of individual health care premium Option to participate in a company-sponsored 401(k) Training and education Professional development; all employees have access to a third party professional coach This role is available for remote work in the following states: Arizona Delaware Florida Georgia Maryland North Carolina New Jersey New York STATE (NYC residents excluded) Pennsylvania South Carolina Texas Wisconsin If you reside outside of the above locations, you will not be considered for this role. Energage is a remote workplace with employees in various US locations. While our employees enjoy the flexibility of daily remote work, they are also given the occasional opportunity for in person interaction. This includes in our office in Exton Pa, or in a coworking space/out in their local area. Please note we do NOT hire outside of the following areas: AZ, DE, FL, GA, MD, MI, NC, NE, NJ, NY STATE (NYC residents excluded) PA, SC, TN, TX, WI Please note: Energage has an office in Exton, PA. While our employees primarily work remote, we are unable to hire anyone outside of these locations. About Energage: Energage is a purpose-driven company that helps organizations turn employee feedback into useful business intelligence and credible employer recognition through Top Workplaces. Built on 19 years of culture research and the results from 23 million employees surveyed across more than 70,000 organizations, Energage delivers the most accurate competitive benchmark available. With access to a unique combination of patented analytic tools and expert guidance, Energage customers lead the competition with an engaged workforce and an opportunity to gain recognition for their people-first approach to culture. For more information or to nominate your organization, visit energage.com or topworkplaces.com. Energage is committed to fostering a diverse and inclusive environment. We are proud to be an equal opportunity employer. Energage encourages all qualified candidates to apply, including those of any race, color, religion, gender, gender identity or expression, sexual orientation, national origin, genetics, disability, age, or veteran status. #J-18808-Ljbffr Energage, LLC