Security Analyst II

Harborstone Credit Union•Lakewood, WA

1d•$102,332 - $153,499•Hybrid

About The Position

Join Our Team at Harborstone Credit Union—Voted one of Washington’s Best Workplaces! Are you ready to make a difference in the lives of others while building your own career? At Harborstone Credit Union (HCU), we’re more than just a financial institution—we’re a community dedicated to building dreams and changing lives for generations to come! This position is on-site and hybrid eligible after completing successful introductory period. FLSA: Salary Exempt The Security Analyst II performs core functions of day-to-day operations for in-place security solutions and the monitoring, identification, investigation, and resolution of security incidents detected by those systems to protect the organization’s information assets. Secondary tasks include involvement in the implementation of new security solutions, participation in the creation and or maintenance of policies, standards, baselines, guidelines, and procedures as well as conducting vulnerability audits and assessments. The position works closely with IT Leadership to design, implement, and management of the aforementioned. The position is also expected to be fully aware of Harborstone’s security goals as established by stated policies, procedures, and guidelines and to actively work towards upholding those goals. The position reports indirectly to the SVP/Chief Information Officer to ensure appropriate segregation of security responsibilities.

Requirements

Experienced security professional with strong hands-on knowledge of incident response, vulnerability management, security monitoring, and cybersecurity tools.
Strong communicator and problem solver who can translate complex security risks into clear, actionable recommendations for leadership and business partners.
Self-motivated, adaptable teammate who demonstrates sound judgment, protects confidential information, supports compliance expectations, and continuously improves Harborstone’s security posture.
Bachelor’s degree in computer science, Information Security, or related field
5-7 years or more experience in information security, with a focus on incident response, vulnerability management, and security monitoring software, required. Maintain strict confidentiality and utmost discretion handling sensitive information and security incidents, ensuring all data and findings are protected and shared only with authorized personnel
Experience in the financial services industry, particularly within credit unions
Advanced knowledge of Windows Desktop/Server Operating Systems, Active Directory, Patch Management, Security Information and Event Management, Endpoint Detect and Response, Network Access Control, Vulnerability Scanning, and Network Administration
Knowledge of regulatory requirements and industry standards related to information security
Ability to provide guidance to junior security analysts and other team members
PowerShell or other scripting language/automation skills
Ability to work non-standard hours as necessary to address incidents
Proven analytical and problem-solving skills, ability to learn new systems, and proficiency with security tools and technologies
Highly adaptable and flexible; able to adjust quickly and effectively prioritize and execute tasks
Strong customer service orientation with excellent written and oral communication skills to communicate complex issues clearly and concisely in business-friendly and user-friendly language
Highly self-motivated and willing to learn and adapt to rapidly changing technology and share knowledge with other team members
Hold one or more of the following certifications: Security+, GIAC Information Security Fundamentals, Microsoft Certified Systems Administrator: Security, or CISSP, required
Must be bondable
Ability to communicate effectively in verbal, written, and electronic formats with internal and external stakeholders.
Ability to read, comprehend, and respond to written and verbal instructions and information.
May be required to sit or stand for extended periods, depending on job duties.
May involve repetitive motions, including keyboarding and handling office equipment.
May require stooping, bending, squatting, or reaching occasionally.
May be required to lift and carry items weighing up to 20 pounds.
Ability to navigate office environments, including walking between workstations, meeting rooms, and member service areas.
Travel may be required as needed to support business operations and organizational needs.

Nice To Haves

10 years or more experience in information security, with a focus on incident response, vulnerability management, and security monitoring software, preferred
Hold one or more of the following certifications: CCSP, CISA, or CISM, preferred

Responsibilities

Monitor, investigate, and respond to security alerts, incidents, vulnerabilities, and emerging threats to protect Harborstone’s systems, data, and information assets.
Maintain and improve cybersecurity controls, policies, procedures, reporting, and documentation in alignment with regulatory requirements and industry standards.
Partner with IT Leadership on security architecture, vendor risk reviews, disaster recovery planning, awareness training, and recommendations that strengthen the organization’s overall security posture.
Lead day-to-day cybersecurity operations by monitoring security tools, investigating alerts and incidents, coordinating response efforts, and protecting Harborstone’s systems, data, and information assets.
Manage vulnerability, risk, and control activities by supporting assessments, penetration testing, remediation recommendations, vendor security reviews, and disaster recovery planning.
Maintain and strengthen the security program through policy and procedure documentation, regulatory compliance support, leadership reporting, security awareness coordination, and continuous improvement of security controls.
Ensure the confidentiality, integrity, and availability of the data residing on or transmitted to/from/through the organizations workstations, laptops, servers, and other systems and in databases and other data repositories
Monitoring and analysis of security alerts and incidents, conduct investigations, collaborate with leadership and coordinate response efforts to mitigate threats
Use security tools and technologies to monitor for suspicious activity and potential threats
Oversee and respond to regular vulnerability assessments, penetration testing, identification of potential security risks, and collaborate with IT Leadership to recommend remediation
Produce, maintain, document, and enforce; security policies, procedures, incident response reports, root cause analysis, and standards to protect information assets
In support of the Vendor Management Program, review and document SOC reports, disaster recovery, and similar documentation of current and potential business partners. Provide feedback and recommendations to IT Leadership
Participate in planning and design of business continuity and disaster recovery plan
Keep current with and ensure proactive and timely compliance with relevant regulations and standards, such as PCI-DSS, NCUA, DFI, FFIEC, and other regulatory guidelines
Prepare and present detailed reports on security incidents, findings, and recommendations to IT Leadership
Prepare reports for Cybersecurity Committee regarding current and potential threats
Assist IT Leadership in development of Annual Cybersecurity Report to the Board of Directors
Coordinate with IT Leadership and Training and Development to promote a comprehensive and cohesive approach to security and security awareness training programs
Collaborate with IT Leadership on security architecture and systems to protect critical infrastructure and sensitive data
Stay up to date on the latest cybersecurity threats, trends, and technologies, ensuring the organization's defenses are continuously improved
Ensure continuous maturity of appropriate security controls, policies, and procedures in compliance with industry standards (NIST, CIS 18, etc.).
Keep current with FS-ISAC, ISC2, and other sources
Upholds legal, regulatory and compliance requirements unique to the role, in addition to Bank Secrecy Act, Anti-Money Laundering, OFAC, and Information Security policies and procedures.
Completes annually required compliance related courses and required Product and Process Knowledge competency testing, in addition to job related courses.
You may be expected to perform other duties as assigned

Benefits

Competitive pay: $102,332.39 - $153,498.59 annually dependent on experience
401(k) with generous employer match
Medical, dental, and vision coverage
Employer contribution toward dependent medical premiums
Generous paid time off and holidays
Professional development and career growth opportunities
Employee appreciation and recognition programs
Discounted employee financial products
A mission-driven culture focused on helping members and communities thrive
A collaborative, supportive culture that values work-life balance and employee well-being