Senior Information Security Analyst

What you'll do

• Manage major security programs including vulnerability management, third-party risk, and business continuity.
• Lead end-to-end risk assessment processes and document data-backed risk conclusions.
• Design and document complex internal controls using automation and AI tools to scale operations.
• Provide "effective challenge" to engineering partners to mature risk processes and reduce security risks.
• Author high-quality policy updates and manage KRI reporting for leadership and governance committees.
• Act as an escalation point and reviewer to ensure the quality of work from junior analysts.
• Monitor regulatory changes and industry trends to align them with business requirements.

What we're looking for

• 6+ years of experience in security GRC, technology risk, technology audit, or security operations with senior-level ownership.
• Expert-level depth in at least one security domain such as vulnerability management, SDLC, application security, or cloud computing.
• Hands-on command of the CIA triad, control design and operation, and frameworks like SOC 2, ISO 27001, or NIST CSF.
• Strong knowledge of security controls for cloud computing and third-party SaaS, including logical access and vulnerability governance.
• Fluency in the structure and content of audit reports and risk assessments, including testing and results reporting.
• Ability to use professional judgment and quantifiable methods to drive stakeholders toward sound risk acceptance or treatment decisions.
• Strong cross-disciplinary communication skills to influence partners across Engineering, business, Compliance, and Legal.
• Moderate understanding of financial services operations and Product/Engineering; experience in regulated financial services is preferred.
• Professional designations such as CISSP, CISA, CISM, or AWS Cloud certifications are preferred.
• Experience mentoring analysts or auditors or leading a governance committee is preferred.