Cyber Security Analyst - Corp. IT Security - Firstbankpr

FirstBank Puerto Rico • San Juan, PR

7d

About The Position

The Cyber Security Analyst supports the Information Security Manager and Chief Information Security Officer (CISO) in identifying, mitigating, and responding to information security risks. The role performs complex analysis of high-impact and sensitive systems to determine appropriate security approaches based on anticipated threat vectors, and conducts cybersecurity key-management tasks and strategies aligned with FirstBank's cybersecurity posture.

The position is part of the Corporate Security Office, which manages the Bank's information security strategy, including developing IT standards, policies, and procedures to comply with applicable laws, regulations, and industry best practices. The analyst works with internal teams and service providers to monitor security, manage vulnerabilities, support incident response, assess risk, and report on the Corporation's cybersecurity posture.

Requirements

• Bachelor's degree in information technology, computer science, engineering, or business, or an equivalent combination of education and experience sufficient to perform the job functions.
• At least 3–5 years of information security experience or experience in a similar position within the banking industry.
• Ability to map cybersecurity controls to applicable security frameworks, including COBIT, ISO, and NIST.
• Ability to map complex technical requirements, functionality, and capabilities to security controls, policies, and practices.
• Ability to interpret complex ideas and information accurately and communicate them effectively to stakeholders.

Nice To Haves

• Master's degree in computer science, information systems, engineering, or an MBA.
• CISSP, CISM, or a similar certification.

Responsibilities

• Provide feedback on cybersecurity matters during the development and update of information security policies, procedures, standards, and guidelines.
• Assist the Information Security Manager and/or CISO in responding to and mitigating cybersecurity risks and improving internal controls.
• Help select and tailor approaches, methods, and tools to support service offerings for applicable business units.
• Oversee and monitor critical IT and information security third-party service providers and monitor compliance with agreed contracts and terms.
• Coordinate with the MSSP and technology teams to ensure timely response, escalation, evidence preservation, and closure of security events.
• Coordinate penetration tests and vulnerability scans, evaluate results, and help identify and remediate security flaws and vulnerabilities.
• Assess and prioritize vulnerabilities using a risk-based approach to expedite remediation.
• Monitor and analyze security alerts, events, threat intelligence, and telemetry from SOC/MDR, EDR, email, network, cloud, WAF, DLP, vulnerability, and related security platforms.
• Participate in the Vulnerability Management Board and oversee patch-management efforts, providing feedback and best practices to remediate outstanding risks and flaws.
• Analyze vulnerabilities and exposure, prioritize findings based on exploitability and business impact, and track remediation through closure.
• Participate in the incident response process with the ERM Department to detect, investigate, and recover from security incidents, and assist with incident response plans when applicable.
• Work with the IT Risk Management unit to execute the Cyber Security Risk Assessment.
• Periodically report the Corporation's cybersecurity posture to senior and executive management.
• Research and analyze emerging and disruptive IT and information security trends that may affect the Corporation.
• Analyze external threats targeting the financial industry and use internal data stores to gauge potential impacts on business operations.
• Monitor vulnerability notices and provide engineering support for security patch distribution.
• Map cybersecurity controls to applicable frameworks, including COBIT, ISO, and NIST.
• Map complex technical requirements, functionality, and capabilities to prescribed security controls, policies, and practices.
• Accurately interpret complex ideas and information and communicate them effectively to applicable stakeholders.

What This Job Offers

• Job Type: Full-time
• Career Level: Mid Level