Cyber Threat Management Analyst, Specialist

Vanguard•Fort Worth, TX

1d•Hybrid

About The Position

The Cyber Threat Management Analyst, Specialist supports cybersecurity alert and incident response, threat monitoring, security control development, vulnerability assessment, and security analysis. The role identifies complex attack patterns, investigates malicious activity across logs and network traffic, recommends mitigation strategies, and provides written assessments on threats, vulnerabilities, and technologies relevant to Vanguard infrastructure. It also collaborates with IT and business teams to communicate findings and support enterprise security initiatives. The position leads technical execution of an enterprise-scale Oversharing Remediation Program, analyzing complex permissions and access models to identify and remediate overexposed sensitive data. It designs remediation options for leadership and supports AI and Copilot readiness. The role also designs and implements Cloud DLP policies across IaaS, PaaS, and SaaS platforms, including detection logic, policy tuning, and exception handling. The analyst engineers automation across DLP, data exposure, and data security posture workflows, such as quarantining sensitive data, notifying and resolving data-owner issues, handling cases with no identifiable owner, and running change-approved remediation continuously. In collaboration with IAM teams, the role defines criteria, exceptions, and tests for removing stale and orphaned access in accordance with identity governance requirements. It works across SOC, infrastructure, IAM, and vendor teams, including obtaining change approvals through CAB. Vanguard uses a hybrid working model for the majority of its crew members, supporting flexibility alongside in-person learning, collaboration, and connection. Vanguard is not offering visa sponsorship for this position.

Requirements

At least three years of related work experience, including two years of experience in threat analysis.
An undergraduate degree in a related field or an equivalent combination of training and experience.
Must obtain CISSP within one year of hire.

Responsibilities

Respond independently to cybersecurity alerts, incidents, and related security investigations; identify complex attack patterns and suggest mitigation strategies.
Support processes, tools, and measures for monitoring and detecting compromises, risks, vulnerabilities, network security threats, and threat-actor tools and tactics.
Facilitate security operations and incident response technologies and methodologies.
Develop, manage, maintain, and enhance security-platform controls, including alerts, rules, policies, and signatures.
Monitor the network environment for evolving cyber threats and provide preventive and remedial solutions.
Analyze logs, traffic flows, and other investigative evidence to identify malicious activity.
Conduct penetration testing, vulnerability assessments, and threat modeling; evaluate risks and make recommendations.
Prepare written assessments focused on threats, vulnerabilities, and technologies relevant to Vanguard infrastructure.
Collaborate with IT and business teams to distribute findings and address incidents effectively; support enterprise-wide security initiatives and projects.
Participate in special projects and perform other duties as assigned.
Lead technical execution of the Oversharing Remediation Program across collaboration and cloud storage platforms.
Analyze complex permission models, identify overexposed sensitive data, and support remediation and AI and Copilot readiness.
Design, build, and implement Cloud DLP policies across IaaS, PaaS, and SaaS, including detection logic, tuning, and exception handling.
Engineer automated workflows for DLP, data exposure, and data security posture management, including quarantine, owner notification, fallback handling, and continuous change-approved remediation.
Work with IAM teams to define criteria, exceptions, and testing for removal of stale and orphaned access in alignment with identity governance requirements.
Coordinate across SOC, infrastructure, IAM, and vendor teams to secure approvals for changes through CAB.