Information Security Data Analyst

The Clearing House•Charlotte, NC

6d•Hybrid

About The Position

The Clearing House is seeking an analytical and technically skilled Information Security Data Analyst to support cybersecurity risk reporting, data analysis, and performance measurement across its enterprise Information Security program. The role transforms complex cybersecurity data into accurate, actionable insights for operational decisions, risk management, regulatory oversight, and executive reporting. It works closely with Security Operations, Vulnerability Management, Identity and Access Management, Infrastructure, and Technology Risk teams to develop automated reporting, dashboards, and metrics that provide visibility into the organization's cybersecurity posture. A key focus is vulnerability management analytics: assessing vulnerability exposure, remediation performance, asset criticality, and compliance with remediation timelines. The analyst also supports security metrics and risk reporting, data integration and automation, data quality, and continuous improvement. The position requires communicating findings to technical teams and senior leadership, supporting governance forums, and preparing analysis and evidence for audits, regulatory examinations, and management reviews. The Clearing House Payments Company L.L.C. is a bank-owned industry utility providing payment infrastructure. It operates the CHIPS, RTP, EPN, and Image Exchange Network payment systems, as well as other payment-related services. Candidates report to the office three days each week; onsite requirements may change. Travel may be required.

Requirements

Bachelor's degree in Data Analytics, Computer Science, Information Systems, Cybersecurity, Mathematics, Statistics, or a related discipline, or equivalent professional experience.
Strong proficiency in SQL, including querying, joining, aggregating, and analyzing large datasets.
Experience using Python, PowerShell, or similar scripting languages for data analysis and automation.
Experience developing dashboards and reports using Microsoft Power BI, Tableau, or comparable business intelligence platforms.
Advanced Microsoft Excel skills, including pivot tables, data transformation, formulas, and analytical reporting.
Experience integrating and analyzing data from multiple enterprise systems using APIs, databases, or automated data extracts.
Understanding of cybersecurity concepts, including vulnerabilities, asset management, security incidents, risk ratings, and remediation processes.
Strong analytical and problem-solving skills, including the ability to identify trends, anomalies, and data inconsistencies.
Experience developing metrics, performance indicators, and recurring management reports.
Ability to communicate complex analytical findings clearly to technical and nontechnical audiences.
Strong attention to detail and organizational skills, with the ability to manage multiple reporting requirements.
Must be legally authorized to work in the United States.

Nice To Haves

Experience working in banking, financial services, payment systems, or another highly regulated industry.
Experience analyzing vulnerability data and familiarity with security platforms.
Understanding of vulnerability severity ratings, CVSS, CISA Known Exploited Vulnerabilities (KEV), and risk-based vulnerability prioritization.
Familiarity with cybersecurity frameworks and regulatory expectations, including NIST CSF, FFIEC guidance, and relevant financial services requirements.
Experience developing executive dashboards and reporting for risk committees or senior management.
Knowledge of statistical analysis, trend forecasting, data modeling, and data visualization best practices.
Relevant certifications such as Microsoft Power BI Data Analyst, CompTIA Security+, or other data analytics or cybersecurity certifications.

Responsibilities

Collect, analyze, validate, and interpret cybersecurity data from multiple enterprise security platforms.
Develop and maintain dashboards, reports, and analytical models to measure cybersecurity risk, operational effectiveness, and control performance.
Translate technical data into actionable insights for Information Security leadership, executive management, and risk committees.
Identify trends, anomalies, emerging risks, and improvement opportunities across cybersecurity operations.
Establish repeatable reporting processes and automate data collection, transformation, reconciliation, and reporting.
Support the development of cybersecurity key risk indicators, key performance indicators, and operational metrics.
Document data sources, metric definitions, calculations, assumptions, and reporting methodologies.
Develop and maintain vulnerability reporting for on-premises infrastructure, cloud environments, applications, and enterprise platforms.
Analyze vulnerability data from Tenable, ServiceNow Vulnerability Response, and other security tools.
Track critical and high-severity vulnerabilities, remediation timelines, aging, exceptions, and exposure beyond established service-level agreements.
Correlate vulnerability findings with asset inventories, business criticality, ownership, and operational context to improve risk-based prioritization.
Identify recurring vulnerabilities, remediation bottlenecks, data quality issues, and emerging exposure trends.
Distinguish newly discovered vulnerabilities from existing exposure, overdue remediation, and changes resulting from expanded scanning coverage.
Partner with infrastructure and application teams to validate vulnerability data, identify remediation owners, and improve reporting accuracy.
Prepare metrics, trend analysis, and executive-level reporting for vulnerability governance meetings.
Measure remediation progress and assess the effectiveness of vulnerability management activities.
Design, develop, and maintain Information Security KRIs and KPIs aligned with enterprise risk management requirements.
Produce recurring cybersecurity reporting for executive leadership, risk committees, and other governance forums.
Analyze trends in security incidents, vulnerability exposure, identity controls, security monitoring, and remediation effectiveness.
Establish consistent calculation methodologies, reporting thresholds, and data quality controls.
Investigate unexpected metric changes and distinguish actual risk increases from changes in detection capabilities, scanning coverage, or data sources.
Partner with Technology Risk and other stakeholders to ensure reporting is accurate, traceable, and aligned with approved risk definitions.
Prepare supporting analysis and evidence for internal audits, regulatory examinations, and management reviews.
Develop historical trending and comparative analysis to help leadership evaluate security investments and operational improvements.
Develop automated data pipelines and reporting solutions using SQL, Python, Power BI, APIs, and other approved enterprise technologies.
Integrate data from cybersecurity platforms and cloud security tools.
Build interactive dashboards for analyzing security metrics by business service, asset criticality, technology platform, ownership, and risk category.
Perform data cleansing, normalization, reconciliation, and validation across multiple systems.
Identify inconsistencies between security tools and authoritative asset or configuration management data.
Create reusable datasets, reporting templates, and standardized analytical models.
Work with technology teams to improve data accessibility, reliability, and reporting automation.
Apply appropriate data access controls and handling practices to sensitive cybersecurity information.
Establish controls to ensure cybersecurity reporting is complete, accurate, consistent, and reproducible.
Document data lineage, business rules, transformations, and calculation logic supporting key security metrics.
Investigate data discrepancies and collaborate with system owners to resolve underlying issues.
Identify opportunities to simplify reporting and eliminate redundant or manual activities.
Develop quality assurance checks for missing records, duplicate findings, incorrect asset classifications, and inconsistent remediation statuses.
Recommend improvements to cybersecurity data models, reporting architecture, and analytical capabilities.
Support continuous improvement initiatives that strengthen cybersecurity risk measurement and management.
Partner with Information Security teams to understand operational processes, reporting requirements, and cybersecurity risk drivers.
Collaborate with Infrastructure, Cloud Engineering, Application Development, Enterprise Architecture, and Technology Risk teams.
Summarize technical findings concisely, communicating business impact and recommended actions.
Support leadership with ad hoc analytical requests, regulatory inquiries, and emerging cybersecurity issues.
Present analytical findings and explain trends, assumptions, and limitations to technical and nontechnical stakeholders.