Information Security Data Analyst

The Clearing House•Charlotte, NC

8d•Hybrid

About The Position

The Clearing House is seeking an analytical and technically skilled Information Security Data Analyst to support cybersecurity risk reporting, data analysis, and performance measurement across its enterprise Information Security program. The role transforms complex cybersecurity data into accurate, actionable insights for operational decision-making, risk management, regulatory oversight, and executive reporting. The analyst works with Security Operations, Vulnerability Management, Identity and Access Management, Infrastructure, and Technology Risk teams to create automated reporting, dashboards, and metrics that provide visibility into the organization's cybersecurity posture. A major focus is vulnerability management analytics: assessing vulnerability exposure, remediation performance, asset criticality, and adherence to remediation timelines. The analyst also develops and maintains security metrics and risk reporting, integrates and visualizes security data, improves data quality and reporting processes, and communicates findings to technical teams and senior leadership. The position supports governance forums, audits, regulatory examinations, management reviews, and ad hoc analytical requests. The Clearing House Payments Company L.L.C. is a bank-owned industry utility that provides payment infrastructure. It operates the CHIPS high-value wire-transfer system, the RTP instant payments system, the EPN automated clearinghouse network, and the Image Exchange Network, as well as other payment-related services.

Requirements

Bachelor's degree in Data Analytics, Computer Science, Information Systems, Cybersecurity, Mathematics, Statistics, or a related discipline, or equivalent professional experience.
Strong proficiency in SQL, including querying, joining, aggregating, and analyzing large datasets.
Experience using Python, PowerShell, or similar scripting languages for data analysis and automation.
Experience developing dashboards and reports using Microsoft Power BI, Tableau, or comparable business intelligence platforms.
Advanced Microsoft Excel skills, including pivot tables, data transformation, formulas, and analytical reporting.
Experience integrating and analyzing data from multiple enterprise systems using APIs, databases, or automated data extracts.
Understanding of cybersecurity concepts, including vulnerabilities, asset management, security incidents, risk ratings, and remediation processes.
Strong analytical and problem-solving skills, including the ability to identify trends, anomalies, and data inconsistencies.
Experience developing metrics, performance indicators, and recurring management reports.
Ability to communicate complex analytical findings clearly to technical and nontechnical audiences.
Strong attention to detail, organizational skills, and ability to manage multiple reporting requirements.
Must be legally authorized to work in the United States.

Nice To Haves

Experience working in banking, financial services, payment systems, or another highly regulated industry.
Experience analyzing vulnerability data and familiarity with security platforms.
Understanding of vulnerability severity ratings, CVSS, CISA Known Exploited Vulnerabilities (KEV), and risk-based vulnerability prioritization.
Familiarity with cybersecurity frameworks and regulatory expectations, including NIST CSF, FFIEC guidance, and relevant financial services requirements.
Experience developing executive dashboards and reporting for risk committees or senior management.
Knowledge of statistical analysis, trend forecasting, data modeling, and data visualization best practices.
Relevant certifications such as Microsoft Power BI Data Analyst, CompTIA Security+, or other data analytics or cybersecurity certifications.

Responsibilities

Collect, analyze, validate, and interpret cybersecurity data from multiple enterprise security platforms.
Develop and maintain dashboards, reports, and analytical models that measure cybersecurity risk, operational effectiveness, and control performance.
Translate complex technical data into actionable insights for Information Security leadership, executive management, and risk committees.
Identify trends, anomalies, emerging risks, and opportunities for improvement across cybersecurity operations.
Establish repeatable reporting processes and automate data collection, transformation, reconciliation, and reporting.
Support the development of cybersecurity key risk indicators, key performance indicators, and operational metrics.
Document data sources, metric definitions, calculations, assumptions, and reporting methodologies.
Develop and maintain vulnerability reporting across on-premises infrastructure, cloud environments, applications, and enterprise platforms.
Analyze vulnerability data from Tenable, ServiceNow Vulnerability Response, and other relevant security tools.
Track critical and high-severity vulnerabilities, remediation timelines, aging, exceptions, and exposure beyond established service-level agreements.
Correlate vulnerability findings with asset inventories, business criticality, ownership, and operational context to improve risk-based prioritization.
Identify recurring vulnerabilities, remediation bottlenecks, data quality issues, and emerging exposure trends.
Report separately on newly discovered vulnerabilities, existing exposure, overdue remediation, and changes resulting from expanded scanning coverage.
Partner with infrastructure and application teams to validate vulnerability data, identify remediation owners, and improve reporting accuracy.
Prepare metrics, trend analysis, and executive-level reporting for vulnerability governance meetings.
Measure remediation progress and assess the effectiveness of vulnerability management activities.
Design, develop, and maintain Information Security KRIs and KPIs aligned with enterprise risk management requirements.
Produce recurring cybersecurity reporting for executive leadership, risk committees, and other governance forums.
Analyze trends in security incidents, vulnerability exposure, identity controls, security monitoring, and remediation effectiveness.
Establish consistent calculation methodologies, reporting thresholds, and data quality controls.
Investigate unexpected metric changes and distinguish actual risk increases from changes in detection capabilities, scanning coverage, or data sources.
Work with Technology Risk and other stakeholders to ensure reporting is accurate, traceable, and aligned with approved risk definitions.
Prepare supporting analysis and evidence for internal audits, regulatory examinations, and management reviews.
Develop historical trending and comparative analysis to help leadership evaluate security investments and operational improvements.
Develop automated data pipelines and reporting solutions using SQL, Python, Power BI, APIs, and other approved enterprise technologies.
Integrate data from cybersecurity platforms and cloud security tools.
Build interactive dashboards for analysis by business service, asset criticality, technology platform, ownership, and risk category.
Cleanse, normalize, reconcile, and validate data across multiple systems, identifying inconsistencies with authoritative asset or configuration management data.
Create reusable datasets, reporting templates, and standardized analytical models.
Work with technology teams to improve data accessibility, reliability, and reporting automation.
Apply appropriate data access controls and handling practices to sensitive cybersecurity information.
Establish controls to ensure cybersecurity reporting is complete, accurate, consistent, and reproducible.
Document data lineage, business rules, transformations, and calculation logic for key security metrics.
Investigate data discrepancies and collaborate with system owners to resolve underlying issues.
Simplify reporting processes and eliminate redundant or manual activities.
Develop quality assurance checks for missing records, duplicate findings, incorrect asset classifications, and inconsistent remediation statuses.
Recommend improvements to cybersecurity data models, reporting architecture, and analytical capabilities.
Support continuous improvement initiatives that strengthen cybersecurity risk measurement and management.
Partner with Information Security teams to understand operational processes, reporting requirements, and cybersecurity risk drivers.
Collaborate with Infrastructure, Cloud Engineering, Application Development, Enterprise Architecture, and Technology Risk teams.
Communicate technical findings as concise summaries of business impact and recommended actions.
Support leadership with ad hoc analysis, regulatory inquiries, and emerging cybersecurity issues.
Present analytical findings and explain trends, assumptions, and limitations to technical and nontechnical stakeholders.