Information Security Analyst

Information Security Analyst

Responds to Information Security incidents working in a 24x7 operations department. Recommends risk mitigation, implements appropriate security safeguards, tests proposed security solutions, and performs audit/compliance and forensic activities as needed. Provides support for operational security tools and technologies by responding to alerts and troubleshooting issues. Assists with a variety of duties including analysis, system administration, technology testing, incident response and training junior security operations analysts. Serves as the primary interface to the Information Technology Operations Center personnel when responding to incidents.

1. Reviews, validates, classifies, and responds to security events.

2. Analyzes a variety of network and host-based security logs (Firewalls, NIDS, HIDS, Syslog, etc.).

3. Monitors and analyzes network traffic and IDS/IPS alerts, investigating intrusion attempts and performing in-depth analysis of exploits and attacks.

4. Conducts proactive threat and vulnerability research.

5. Participates in incident reporting for high priority events, from initial response to triage, to determining remediation actions and escalation paths.

6. Performs security Incident Event Management (SIEM) console monitoring and correlation.

7. Evaluates new security technology for the organization through quantitative and qualitative measures.

8. Provides skilled technical assistance in Information Security strategy and planning.

9. Performs firewall rule changes based on submitted requests.

10. Presents security research analysis and recommendations to the Information Security management team.

11. Resolves Hotline issues (issue resolution, security incident reporting) and Abuse issues (email, phishing attacks, social engineering calls).

12. Continuously monitors regulatory compliance through implemented Information Security technologies.

13. Administers, monitors and troubleshoots antivirus activities, and email gateway issues. Configures and tests new IDS/IPS rules based on in-depth security analysis.

14. Performs network and host DLP monitoring and logging.

15. Performs application whitelisting and file integrity monitoring.

16. Conducts threat and vulnerability research, intelligence and monitoring.

17. Maintains and increases professional and technical knowledge by attending workshops, reviewing professional publications, establishing personal networks and participating in professional societies.

18. May provide direction and support to less experienced security engineering staff to orient them and increase their understanding of more complex security analysis and design.

19. May lead moderately complex security projects as assigned.

20. Performs other duties as assigned or apparent.

Supervisory Responsibilities: None

MINIMUM KNOWLEDGE, SKILLS, AND ABILITIES:

• Bachelor's degree in Computer Science or a related field, or equivalent experience

• Four years progressive IT security skills, IT audit experience can be included in experience

• Ability to work shifts based on need and situations in a 24x7 operations department

PREFERRED KNOWLEDGE, SKILLS, AND ABILITIES:

• Systems Security Certified Practitioner (SSCP), Security+, or comparable Information Security certification

• Proven ability performing moderately complex security analysis for information technology

• Thorough knowledge and understanding of the technical Information Security environments and processes

• Excellent oral and written communication skills to effectively interact with internal and external customers

• Technical expertise in anti-virus solutions, virus outbreak management, and the ability to differentiate virus activity from directed attack patterns

• Technical expertise in Intrusion Prevention System (IPS)/Intrusion Detection System (IDS), SIEMs and other Computer Network Defense (CND) security tools

• Ability to work with internal and external personnel

• Demonstrated attention to detail