Senior Information Security Analyst

COMPANY DESCRIPTION:  Forbright is a nationwide full-service bank and lender helping accelerate the transition to a sustainable and low-carbon economy. Headquartered in Chevy Chase, Maryland, Forbright is committed to accelerating the transition to a sustainable economy by financing visionary leader in clean energy, healthcare, technology, financial services, real estate, and other industries with extraordinary service.
COMPANY CULTURE:  We are a dynamic, high energy, fun, and fast-paced organization that has an exciting growth trajectory, meaningful mission, and embedded responsible environmental, social, and governance practices into our daily interactions. We offer our team members a culture of collaboration, inclusion, flexibility, recognition, and giving back. We look to hire individuals that are passionate about our mission, and who are motivated, customer and results-oriented, innovative, adaptable, and thoughtful.
COMPANY MISSION:  We are a mission-driven institution. We operate a sound dynamic institution that is well capitalized, liquid, profitable and uses best practices to manage risk and assure compliance with laws and regulations. We use Forbright’s capital, capabilities, innovation, and expertise to help our clients succeed and contribute broadly to building a more sustainable future.
JOB SUMMARY:  The primary mission of the Senior Information Security Analyst at Forbright Bank is to support the security operations of the Bank. This role is responsible for identifying, investigating, mitigating, and reporting on potential threats such as phishing, malware, and network attacks through technical and written assessments. The Senior Information Security Analyst provides technical analysis, assessment, and recommendations in security situational awareness, operational, network, and applications systems security monitoring, and vulnerability management.

DUTIES AND RESPONSIBILITIES:

• Identify, investigate, mitigate, and report on potential threats such as phishing, malware, and network attacks through technical and written assessments 
• Perform detailed static and behavioral analyses on emails, applications, websites, and cloud applications 
• Assist with developing, conducting, and reporting on Red, Blue, and Purple Team exercises conducted internally and by 3rd-parties from a technical perspective 
• Assist with penetration testing, results analysis, recommendations, remediation planning and implementation, and reporting 
• Conduct regular assessments of industry best practices and benchmark standards and make recommendations for implementation and reporting 
• Administer enterprise SIEM and Vulnerability Management solutions and related tools, including proactive event monitoring with independent analysis and assessments, containment and remediation recommendations, alert tuning, and cloud and on-premise solutions integrations 
• Utilize incident response procedures and workflows for triage, analysis, notification, escalation, containment, remediation, and reporting 
• Active participation in the Bank’s Security Awareness Program, providing guidance for and conducting IT and Staff training, simulated phishing campaigns, and reporting 
• Provide clear and detailed written analysis, reports, and tickets for both technical and executive audiences 
• Provide after-hours and weekend analysis on an as-needed basis outside of general working hours 

QUALIFICATIONS:

• Bachelor’s degree in information technology or a related technical discipline with at least two years of experience working in a Cybersecurity role required  
• Expertise in threat identification, cybersecurity tools, intrusion detection, and the implementation and maintenance of secured networks and systems required 
• A background with at least three years in Systems Administration or Engineering focusing on Windows-based environments is required; additional familiarity with Linux, Mac, and Cloud environments (AWS, Azure) is preferred 
• Cybersecurity-related certifications (or ability to obtain certification) such as Certified Ethical Hacker (CEH), GIAC Certified Incident Handler (GCIH), CERT Certified Computer Security Incident Handler (CSIH), GIAC GSEC Certified (GIAC), CompTIA Cybersecurity Systems (CySA+) preferred  
• Hands-on experience in cybersecurity and network analysis tools, network topologies, intrusion detection methodologies, Windows systems, and preferably Linux systems analysis for evidence of compromise 
• Familiarity with industry best practices and benchmark standards such as NIST SP 800-53, CIS, CISA, FFIEC Booklets, and Critical Security Controls 
• Excellent verbal, written, and interpersonal communication skills 
• Excellent analytical and problem-solving skills 
• Highly organized and efficient, able to work with all