Information Security Analyst Senior

Arkansas Blue Cross•Little Rock, AR

3d•Hybrid

About The Position

The Information Security Analyst is responsible for the operations, administration, and governance of the enterprise security solutions and processes. This is a hybrid role in our Little Rock, AR, location, requiring a minimum of three days in office weekly.

Requirements

Bachelor’s degree in Business, Computer Science, Management Information Systems, or related field. In lieu of degree, five (5) years’ relevant experience will be considered.
Minimum five (5) years' IT security experience with a complex system technology.
Advance knowledge of at least one (1) common information security management framework, such as HIPAA, HITRUST, ISO/IEC 27001, ITIL, NIST, COBIT, and/or ITL.
Detail-Oriented
Critical thinking
Strong analytical skills
Problem sensitivity
Ingenuity
Project management skills
Excellent communication skills
Ability to build collaborative relationships
Active Listening
Business Compliance
Computer Literacy
Coordinating Resources
Critical Thinking
Deductive Reasoning
Interpersonal Relationship Management
Operations Coordination
Oral Communications
Problem Sensitivity
Process Improvements
Systems Analysis
Time Management
Written Communication

Nice To Haves

System analysis experience preferred.
Project management experience preferred.
Data testing and/or software application testing preferred.
Professional security management certification, such as a HITRUST certification (CCSFP), Certified Information Systems Security Professional (CISSP), Certified Information Security Manager (CISM), Certified Information Systems Auditor (CISA) or other similar credentials preferred.

Responsibilities

Asset Security: Provides guidance and policy expertise for data security, specifically regarding data classification, data storage, data transmission, and data lifecycle. Sets baseline configurations and monitors data governance. Sets policy and enforcement on security standards, such as file permissions, encryption, cloud data security, network assets, endpoint requirements, and others.
Communications and Network Security: Provides/supports network monitoring solutions within SOC/SIEM implementation. Handles initial incident response functions. Provides limited consultation to support elements within this domain. Oversees implementation, configuration, maintenance, and changes for all network security capabilities and assets.
Identity and Access Management: Provides account security management and control across all account security systems. Manages privileged access management entitlement review/approvals. Conducts usage audits, verifies removal and retired accounts, approves launcher requests, and provides end user support. Creates, modifies, deletes, and retires member accounts. Manages role entitlement process. Maintains Workday integration. Manages access management application/system updates and testing.
Security & Risk Management: Provides guidance to business partners for all information security-related issues and identified security risks. Creates, manages, and enforces information security policy. Provides oversight of framework compliance. Manages enterprise audit remediation and CAP management. Manages vulnerability management plan. Conducts anti-phishing campaigns. Conducts and manages the security awareness and training program. Manages the third party risk management program.
Security Architecture and Engineering: Ensures information security is designed with confidentiality, integrity, and access in mind. Sets security requirements. Ensures system redundancy and fault tolerance. Sets standards for mobile and web security. Ensures security of IoT devices.
Security Assessment and Testing: Provides requested evidence/artifacts for all security-related assessments/audits. Coordinates and schedules security assessments required of the Enterprise. Coordinates and ensures the quality of outside vendor-provided security assessments, risk assessments, and penetration testing of enterprise assets
Security Operations: Applies information security concepts, techniques, and best practices to support incident response plans and capabilities. Conducts and supports investigations, conducts logging and monitoring activities, securely provisions resources, tests disaster recovery plans, and addresses personnel safety and security concerns.
Software Development Security: Provides technical consultation as required. Oversees the static and dynamic scanning of internally developed software within the company and provides reports to ensure proper remediation of code vulnerabilities. Reviews SDLC documentation to ensure compliance with established company and regulatory standards as applicable.
Performs other duties as assigned.
Senior – Proficiency in five (5) security components