Security Analyst II

Description

**Please note: Trean will not sponsor applicants for work visas.**

POSITION SUMMARY:

 The Security Analyst will administer IT security systems to protect the organization's digital assets from unauthorized access. Partner with IT leadership to develop and execute organization-wide best practices for IT security, support cyber security awareness campaigns, and proactively keep the company's security systems up to date. Work independently to monitor computer networks for security-related issues, document and escalate critical issues and incidents, and work with external & internal partners frequently to address security-related issues. 

KEY RESPONSIBILITIES:

1. Enforce information security policies as part of the overall IT security program.
2. Manage and maintain security measures and controls to protect computer systems, networks, and data.
3. Comprehend and enforce standards and procedures for compliance with the statutory and regulatory requirements covering internal and external parties, physical security systems, internet, and computer systems.
4. Manage and maintain vendor risk management procedures: vendor classification, vendor assessments, and vendor performance reviews.
5. Protect digital files and information systems against unauthorized access, modification, or destruction.
6. Remediate vulnerabilities discovered on internal and external security audits.
7. Manage network intrusion detection, and prevention systems.
8. Detect, analyze, respond, and report information security incidents based on companies Incident Response Policy.
9. Improve information security awareness and compliance across the company.
10. Assist with and lead a “security culture” within the organization. 
11. Maintain consistent identity and access management.
12. Stay current on the latest intelligence, including hackers’ methodologies, to anticipate security breaches.
13. Maintain or obtain professional and technical knowledge and industry certifications.
14. Make recommendations to managers about security advancements to best protect the company's systems
15. Perform other activities, duties, and assignments as needed or requested.

Requirements

MINIMUM QUALIFICATIONS:

• 3-8 years or more of work experience as a network/system engineer, security analyst, penetration tester, forensics specialist, or equivalent combination of education and experience. Insurance industry knowledge preferred. 
• Any of the following cyber security certifications are preferred: Certification(s) with an emphasis on security preferred. CompTIA Security+, Microsoft Certified: Security, Compliance, and Identity Fundamentals, any ISACA certifications, or any ISC2 certifications. 
• Knowledge of the following topics preferred:
  • Auditing, monitoring, and risk assessments
  • Security Incident and Event Management (SIEM), log management
  • HIPAA, HITRUST, ISO 27001, NIST, PCI-DSS, ITIL, COSO, COBIT, NAIC Data Security Model Law, CCPA, NYDFS, CIS or similar regulations/frameworks
  • Physical and logical access control
  • TCP/IP, switching, routing, VPNs, Firewalls, and Unified Threat Management (UTM) technologies
  • Intrusion Detection/Prevention Systems (IDS/IPS) technologies
  • Authentication systems, including MFA
  • Vulnerability assessments, penetration testing, 
  • Social engineering
  • Data encryption protocols and algorithms
  • Data classification and data loss prevention (DLP)
  • Microsoft online services: Intune Mobile Device Management (MDM), Microsoft Azure AD, and security center, Microsoft 365 Defender.