Information Security Risk Analyst

Avera•Sioux Falls, SD

3d•Onsite

About The Position

Assists in risk identification, development, and evaluation of information technology security controls including risk mitigation strategies as they apply to both IT and business environments. Delivers and supports evaluation of control designs, evaluation of control operation, reporting of control deficiencies, and remediation strategies. Reviews current processes for improvements in control documentation & testing for effectiveness and efficiency. Also collects and monitors information on security alerts, control failures/unmitigated risks and remediation results to build compliance reports for IT and business management. Provides advisory services for IT controls to projects, teams, and audits by ensuring consistent control implementation through documented processes for identifying control requirements prior to their implementation into production IT environments.

Requirements

The individual must be able to work the hours specified.
To perform this job successfully, an individual must be able to perform each essential job function satisfactorily including having visual acuity adequate to perform position duties and the ability to communicate effectively with others, hear, understand and distinguish speech and other sounds.
Reasonable accommodations may be made to enable individuals with disabilities to perform the essential job functions, as long as the accommodations do not cause undue hardship to the employer.

Nice To Haves

Bachelor's in related area
Certified Information Systems Auditor (CISA) - ISACA
Certified Information Systems Security Professional (CISSP) - International Information System Security Certification Consortium (ISC2)
4-6 years Related experience in IT, project management, compliance or security areas

Responsibilities

Actively participates in assessing and evaluating the current adequacy of the security strategy along with identifying and reporting on risks and controls in the IT and business environments.
Assists with the planning, design, and coordination of business continuity/disaster recovery plans along with threats to the systems/organization, and calculating the impact of potential adverse events.
Identifies, performs, and evaluates the current testing of controls while maintaining and improving the process for evaluation of IT controls through a combination of automated testing and interviewing.
Identifies, analyzes and initiates changes in Information Security policies, procedures, guidelines and standards as needed to ensure overall compliance with federal, state, and local laws and regulations.
Identifies and reviews current advances in all areas of information technology concerning vulnerabilities, security breaches or malicious attacks and current security risk areas for IT.
Coordinates the planning, design, and implementation of legacy application record retention. This includes working with operational owners in evaluating and documenting the risks associated with proposed alternatives.
Assists with internal technology teams on supporting internal and external IT audits.
Assists with and performs internal security and risk assessments as requested by management. Audits and assessments must be continual, as the threat profiles change constantly.
Coordinates implementation of processes and procedures to achieve industry accepted security audit certifications such as SOC.
Assists with simulated emergency exercises as needed for security and business continuity related functions.
Assists with Technology Intake Process in reviewing security aspects of vendor supplied products/service.
Collects information on control failures/unmitigated risks, including a clear description of the risk and its likelihood along with remediation results to build compliance reports for IT and business management.