Information Security Analyst

Sr. Information Security Analyst-Application SecurityAs a key member of our collaborative Cybersecurity team, the Senior Information Security Analyst will serve as a technical lead for securing applications, AI-enabled solutions, and autonomous AI agents across UHS and affiliates. In this role, you will identify, assess, document, and mitigate security vulnerabilities in our traditional and AI-powered applications, guide secure development practices, and partner with architecture, development, infrastructure, and business teams to embed security throughout the software development lifecycle (SDLC) and across emerging AI workflows.Key responsibilities include:Maintains selected information security technologies within guidelines of policies and in keeping with good project management principles.Lead and perform in-depth security assessments of web, mobile, API, cloud-based, and AI-enabled applications and autonomous AI agents through code reviews, using tools such as SAST, DAST, IAST, SCA, manual techniques, and penetration testing, including adversarial AI testing.Periodically reviews deployed security technologies to ensure that the solutions continue to provide the intended protections efficiently and effectively.Work closely with DevOps and engineering teams to integrate security into CI/CD pipelines (DevSecOps) and AI/ML pipelines, and develop secure coding guidance, AI security standards, and runtime control baselines.Identifies gaps in protection and recommends solutions to remediate or mitigate the risks associated with the protection gaps.Document findings and assist in creating reports and metrics for technical and non-technical audiences.Works with staff at all levels in the organization, vendors and contractors to ensure protections are effective, efficient and non-disruptive to the appropriate duties, rights and mission of the individuals and the organization(s) affected.Acts as the subject matter expert (SME) for at least one technology or process, and guides the efforts of 1-3 less experienced staff who assist with the assigned technology or process.Qualifications Position Requirements:Bachelor's degree in Computer Science, Cybersecurity, Information Technology, or related field required.Minimum 5-8 experience in information security, with at least 3 years of dedicated Application Security experience (secure code review or penetration testing).Hands-on experience in Application Security (SAST, SCA, DAST, WAF, ASPM) with a background in secure code development (DevSecOps, SSDLC) required.Experience with security tools such as GitHub Advanced Security, Veracode, Snyk, or similar is preferred.Hands-on experience securing and assessing AI-enabled applications, autonomous AI agents, and AI/ML pipelines is a plus.Proficient with design, configuration, management and support of some or all of the following or similar information security technologies or processes.Anti-malware protections and analysisWeb filtering and securityVulnerability scanning and managementEncryption technologies for data at rest and data in transitMobile device and removable media protection or management systemsAuthentication – including various forms of SSO and MFACloud application securitySecurity Information and Event Management (SIEM) systemsInterpreting Common Vulnerabilities and Exposures (CVE) dataOWASP Top 10NIST AI Risk Management Framework (AI RMF)Device controlData Loss Prevention (DLP)Forensic analysisFamiliarity with risk assessment and risk management concepts or processes.Working knowledge of various regulatory security requirements – particularly Sarbanes-Oxley (SOX), HIPAA, and HITECH.Working knowledge of common cyber security frameworks such as HITRUST, NIST, or others.Working knowledge of scripting languages such as Python, PowerShell, and VB is a plus.Able to plan, organize, manage and execute projects, working with other technical staff, to implement cyber and information security technologies or processes.Able to prioritize multiple tasks and be detail oriented.One or more information security certifications are required – AppSec preferred. (OffSec, TCM, SANS, HTB, ISC²)Excellent communication, interpersonal and project management skillsTravel Requirements: At least 10 % US travel to field locations may be necessary to complete assigned projects.This opportunity provides the following:Challenging and rewarding work environmentGrowth and development opportunities within UHS and its subsidiariesCompetitive CompensationExcellent Medical, Dental, Vision and Prescription Drug Plan401k plan with company matchGenerous Paid Time Off