IT Security Analyst II - IT Security - Lawrenceville, NJ - Full-time - Day

Capital Health (US)•Lawrenceville, GA

3d•$108,139 - $141,294•Onsite

About The Position

The IT Security Analyst II independently owns and manages core information security programs, including third-party risk management (TPRM), Security Awareness Training, and Application Security Assessments. This role serves as a trusted resource for staff and leaders regarding information security policy implementation, interpretation, and compliance, and drafts and maintains information security policies, standards, and procedures. Building on the foundation of the IT Security Analyst I role, this position operates with greater autonomy, owns end-to-end programs and initiatives, and provides mentorship and guidance to less experienced team members. The position assesses and prioritizes information security and cybersecurity risk across the organization, facilitates compliance with regulatory requirements and information security policies, and develops and reports on information security metrics.

Requirements

Bachelor's degree in a relevant field or equivalent experience.
Three years demonstrated experience in cybersecurity, GRC, vulnerability management, TPRM, or related roles, including experience gained as an IT Security Analyst I or in an equivalent role required.
Working knowledge of NIST CSF, HIPAA, or other security/regulatory frameworks required.
CompTIA Security+ required.
Strong working knowledge of desktop, server, storage, virtualization, networking, and security technologies.
Demonstrated ability to independently lead risk assessments, vendor risk reviews, and vulnerability remediation efforts, and to translate technical findings into business risk language for non-technical stakeholders.
Ability to work independently with minimal supervision, exercise sound judgment on risk-based decisions, mentor junior staff, and communicate effectively with both technical and non-technical audiences under time-sensitive conditions.

Nice To Haves

One or more mid-level certifications such as CompTIA CySA+ or ISACA CRISC preferred (or equivalent).
Progress toward or attainment of ISACA CISM, CISA, or ISC2 CISSP is a plus.
A+, Network+, Security+, CySA+, CRISC, or other relevant IT security certifications are a plus.
Special Training: A+, Network+, Security+, CySA+, CRISC, or other relevant IT security certifications are a plus.

Responsibilities

Owns and manages the third-party risk management (TPRM) program end-to-end, including vendor classification logic, risk scoring methodology, intake routing/workflows, assessment questionnaires, and reassessment tracking; serves as the primary point of contact for vendor risk questions across the organization.
Independently drives vendor risk assessments from initial outreach through closure, including follow-up with unresponsive vendors, review of vendor-submitted documentation, and escalation of high-risk or unresolved vendor relationships to leadership.
Administers the organization's enterprise phishing simulation program, including campaign design and scheduling, execution, data collection, results analysis, and reporting of metrics and trends to leadership.
Performs Application Security Assessments for new and existing software, evaluating security posture and providing risk-based recommendations to stakeholders.
Owns and manages the software request and review process, evaluating new software and vendor tools for security risk prior to approval and onboarding.
Provides broader support to overall GRC program strategy and planning, partnering with the IT Manager on initiatives such as multi-campaign phishing simulation roadmaps, TPRM process improvements, and team capacity/workload planning for a small, high-throughput GRC team.
Researches, drafts, and maintains information security policies, standards, procedures, and performs detailed policy reviews.
Tracks and reports on remediation progress for regulatory and framework-based gap assessments (e.g., HIPAA Security Rule), maintaining a remediation tracker and coordinating with control owners to close identified gaps.
Develops and maintains security awareness training content for staff and management audiences, including designing and updating training presentation materials with current statistics and emerging threat topics.
Coordinates examinations by qualified security assessors for regulations and frameworks such as HIPAA and NIST, working with control owners and external assessors to ensure evidence requests are completed timely and accurately.
Monitors security alerts, analyzes incidents, and contributes to incident response activities in coordination with the Security Operations team and IT Manager.
Manages the exception review and approval process, ensuring exceptions are documented, risk-rated, and reviewed on schedule.
Applies current threat intelligence and security trends to inform TPRM, awareness training, and policy work.
Collaborates closely with the IT Manager and Security Operations team on day-to-day operational challenges and contributes to effective, sustainable solutions as part of a small, high-throughput GRC team.
Mentors and provides guidance to IT Security Analyst I team members and other GRC support staff, including knowledge transfer, review of work products, and onboarding support; serves as a go-to resource for procedural and technical questions within the GRC team.
Maintains comprehensive documentation of TPRM activities, vendor assessments, security awareness training and phishing simulation activities, and policy review work.
Generates and analyzes regular reports on information security metrics (e.g., phishing simulation results, vendor assessment status, remediation tracking) for management review, identifying trends and improvement opportunities.
Fosters a culture of security awareness and best practices within the organization.
Stays informed of industry best practices, emerging threats, and advancements in cybersecurity, and pursues relevant certifications and training to enhance expertise.
Performs other duties as assigned.