Information Security Analyst

Bank of the Orient is an independent Asian Community Bank that has proudly served the financial needs of multiple Bay Area communities for over 55 years and the Texas area. We are committed to excellence in everything we do. We have an opening for the Information Security Analyst supports the operation, monitoring, maintenance, and continuous improvement of the Bank's information security, cybersecurity risk, privacy, technology risk, and third-party risk programs. The role works across security operations, identity and access management, vulnerability management, incident response, cloud and SaaS security, data protection, business continuity/cyber resilience, security awareness, and governance, risk and compliance (GRC). The Analyst also supports the secure adoption and oversight of artificial intelligence (AI), including generative AI and large language model (LLM) technologies, and may serve as backup administrator for selected security and banking applications as needed. ESSENTIAL DUTIES: Support the maintenance and continuous improvement of the Bank's Information Security, Cybersecurity, Technology Risk, Privacy, GRC, Third-Party Risk Management, and Business Continuity/Cyber Resilience programs in alignment with the Bank's risk appetite, policies, and applicable regulatory requirements. Monitor and analyze security events, alerts, logs, and telemetry from endpoints, servers, networks, identity platforms, cloud/SaaS services, email, and other critical systems. Triage, investigate, document, and elevate suspicious activity in accordance with established procedures and service-level expectations. Support security operations technologies such as SIEM/SOAR, EDR/XDR, network security, email security, cloud security, and threat intelligence platforms; assist with alert tuning, use-case development, log-source onboarding, and operational health monitoring. Perform and coordinate vulnerability and exposure management activities, including vulnerability scanning, risk-based prioritization, configuration reviews, patch/remediation tracking, penetration-test findings, security exceptions, and validation of corrective actions. Participate in and coordinate cybersecurity incident response activities, including phishing/business email compromise, credential compromise, malware/ransomware, data exposure, cloud/SaaS incidents, and AI-related security events. Support evidence collection, root-cause analysis, lessons learned, tabletop exercises, and post-incident improvement actions. Support identity and access management (IAM) controls, including multi-factor authentication (MFA), role-based access control (RBAC), privileged access, joiner/mover/leaver processes, periodic access certifications, service accounts, and segregation of duties for critical banking and technology systems. Assist with data security and privacy controls, including information classification, encryption, data loss prevention (DLP), secure file transfer, retention, sensitive-data handling, and monitoring of non-public customer and Bank information. Support security reviews for technology projects, system changes, cloud/SaaS implementations, APIs, integrations, digital banking capabilities, and new vendors. Document security requirements, identify risks/control gaps, and track remediation through implementation. Support secure cloud and modern infrastructure practices, including security configuration and monitoring for Microsoft 365, Azure and/or AWS environments, SaaS applications, remote access, Zero Trust principles, endpoint/device security, and secure network connectivity. Support the Bank's AI security and governance program. Perform security and risk assessments for AI/GenAI use cases and vendors; evaluate risks such as sensitive-information disclosure, prompt injection, insecure output handling, excessive agency, model/supply-chain risk, unauthorized data use, and inadequate logging or access control; and help implement appropriate guardrails, monitoring, human oversight, and acceptable-use requirements. Monitor the use of approved AI-enabled tools and services, where applicable, and support controls for enterprise AI platforms such as Microsoft 365 Copilot, Azure OpenAI, ChatGPT Enterprise, AWS Bedrock, Google Gemini, or equivalent technologies. Assist with evaluation of AI-enabled cybersecurity tools for accuracy, access, data handling, and operational risk. Support third-party/vendor risk management across onboarding, due diligence, contracting, ongoing monitoring, risk assessment, issue remediation, renewal, and termination. Review security documentation such as SOC reports, penetration-test summaries, business continuity information, cyber insurance, privacy practices, subcontractors/fourth parties, and AI/model-provider dependencies where relevant. Collaborate with business owners, Technology, Compliance, Risk, Audit, Operations, and other stakeholders to ensure technology and vendor risks are identified, documented, accepted or remediated, and supported by appropriate controls. Support cybersecurity threat intelligence and threat-informed defense activities using authoritative sources and industry information-sharing channels. Map relevant threats and incidents to recognized frameworks such as MITRE ATT&CK when useful for investigation, control improvement, or reporting. Conduct and coordinate security awareness activities, including phishing simulations, role-based training, emerging-threat communications, secure use of AI/GenAI, social-engineering awareness, and targeted education for employees, contractors, and third parties. Maintain security policies, standards, procedures, risk registers, control evidence, issue trackers, inventories, diagrams, and other documentation. Support regulatory examinations, internal/external audits, risk assessments, and management responses. Develop and analyze cybersecurity metrics, dashboards, key risk indicators (KRIs), control-performance reports, and executive-level materials to identify trends, highlight material risks, and support management decision-making. Maintain current knowledge of cybersecurity threats, AI security risks, privacy and security laws, regulatory guidance, and industry practices relevant to financial institutions. Support alignment, as appropriate, with frameworks such as FFIEC guidance, GLBA, NIST Cybersecurity Framework (CSF) 2.0, NIST AI Risk Management Framework, CIS Controls, and OWASP guidance. Serve as backup security/application administrator for selected Bank systems as assigned, including Fiserv Premier and related applications, with responsibilities focused on secure configuration, access administration, periodic access reviews, logging, and least-privilege controls. Support other operational systems (such as EZ Teller, Business Analytics, or Enterprise Output Manager) when security, access, resilience, or controlled file-transfer support is required. Demonstrate quality customer service with internal and external stakeholders, actively participate in required Bank and compliance training, maintain strict confidentiality of non-public information, and comply with all applicable Bank policies, security requirements, and banking laws and regulations. Perform other duties and special projects as assigned. REQUIREMENTS: Bachelor's degree in Cybersecurity, Information Security, Information Technology, Computer Science, Management Information Systems, or a related discipline; or four (4) or more years of equivalent relevant work experience. Two (2) or more years of experience in information security, cybersecurity operations, technology risk, systems/network administration, IT audit, GRC, or a related technology role is preferred. Experience in banking, financial services, or another regulated environment is strongly preferred. Working knowledge of Windows and Linux operating systems, TCP/IP, DNS, firewalls, VPN/remote access, Active Directory/identity services, Microsoft 365, endpoint management, cloud/SaaS concepts, and common enterprise security architectures. Practical experience with security monitoring, vulnerability management, incident response, IAM/access reviews, third-party risk, security awareness, or GRC activities. Experience across multiple areas is preferred; deep specialization in every area is not required. Knowledge of financial-services cybersecurity and privacy expectations, including GLBA and FFIEC guidance, and working familiarity with recognized security frameworks such as NIST CSF 2.0, CIS Controls, MITRE ATT&CK, and incident-response practices. Working knowledge of AI/GenAI security concepts and risks, with familiarity with resources such as the NIST AI Risk Management Framework and OWASP guidance for LLM/GenAI applications. Direct enterprise AI security experience is preferred but not required. Experience with reporting, data analysis, or query tools such as SQL, Power BI, Excel, or equivalent is preferred. Basic scripting/automation experience with PowerShell, Python, APIs, or workflow/SOAR tools is a plus. Familiarity with Fiserv Premier or other core banking/application security administration is a plus. PREFERRED CERTIFICATIONS: CompTIA Security+, CySA+, SSCP, GSEC, CISA, CISSP, GIAC certifications, Microsoft/Azure or AWS security certifications, or comparable credentials are preferred depending on experience level. The candidate will be subject to investigation through credit checks, reference checks, background checks and fingerprinting checks performed at the time permissible under relevant law. Visit our website at: for additional information. Bank of the Orient is proud to be an Affnitive Action, Equal Opportunity Employer. #J-18808-Ljbffr