Senior Information Security Analyst

Wells Fargo Bank • Charlotte, NC

1d • Hybrid

About The Position

Wells Fargo is seeking a highly motivated Senior Information Security Analyst to support the Findings & Exposure Management Oversight team. The role provides independent oversight across the findings and exposure lifecycle, including intake and prioritization, remediation monitoring, closure assurance, exposure reporting, and Patch Oversight. The analyst partners with accountable owners, operational teams, data owners, risk authorities, and leadership to improve risk visibility, strengthen accountability, challenge remediation outcomes, and support timely escalation and sustained risk reduction.

The position applies lifecycle standards and risk thresholds to findings, security exposures, patch risks, and exceptions from intake through closure or risk acceptance. It reviews intake records, challenges remediation plans and supporting evidence, monitors progress, validates closure evidence, analyzes exposure data, and supports reporting, data-quality reviews, control assessments, and continuous improvement. The analyst also prepares communications for leadership and governance forums and supports less experienced team members.

The position requires working in a hybrid environment from one of the posted locations. It is not available for visa sponsorship, and no relocation allowance is provided.

Requirements

• At least 4 years of Information Security Analysis experience, or equivalent demonstrated through work experience, training, military experience, education, or a combination of these.
• At least 3 years of experience performing information security assessments, findings reviews, security reviews, or control evaluations.
• At least 3 years of experience analyzing security risks, reviewing remediation plans, and escalating missed commitments.

Nice To Haves

• At least 4 years of experience in Information Security, Cybersecurity, Compliance, Findings Management, Vulnerability Management, or Information Security Analysis, or equivalent demonstrated through a combination of work experience, training, military experience, or education.
• At least 3 years of experience interpreting and applying information security policies, standards, control requirements, or regulatory expectations.
• Experience with enterprise findings, issue, vulnerability, exposure, or patch management processes.
• Experience independently challenging remediation plans, exceptions, closure evidence, or residual-risk decisions.
• Experience with compliance reviews, data-quality reviews, or control effectiveness assessments.
• Experience developing security metrics, executive dashboards, trend reporting, or risk exposure analyses.
• Knowledge of information security frameworks and standards such as NIST, ISO 27001, CIS Controls, COBIT, or similar frameworks.
• Knowledge of vulnerability management, patch management, exception management, and remediation practices.
• Experience supporting regulatory, internal audit, or external audit examinations.
• Strong analytical and problem-solving skills, including the ability to reconcile data, identify trends, assess evidence, and translate information into actionable insights.
• Strong written and verbal communication skills, with the ability to present complex risk information to technical and non-technical audiences.
• Ability to build effective relationships, influence outcomes, and provide credible challenge while maintaining independent oversight.
• Bachelor's degree in Information Security, Cybersecurity, Computer Science, Information Technology, Business, or a related field.
• Professional certification such as CISSP, CISM, CRISC, CISA, Security+, or a related certification.
• Knowledge of cloud security concepts and controls within AWS, Azure, or Google Cloud environments.

Responsibilities

• Apply lifecycle standards and risk thresholds to findings, security exposures, patch risks, and exceptions from intake through closure or risk acceptance.
• Review intake records for completeness, risk-based prioritization, and assignment of accountable owners.
• Independently challenge remediation plans, milestones, exception rationale, and supporting evidence.
• Monitor remediation progress, identify barriers and missed commitments, and coordinate central escalation of overdue or material items.
• Validate closure evidence and support independent challenge of residual-risk acceptance rationale before closure or risk acceptance decisions.
• Analyze findings and exposure data to identify trends, aging, data-quality issues, and emerging risks.
• Support certified metrics, executive dashboards, and recurring reporting that connect materiality, trend, ownership, required action, and source records.
• Perform recurring data-quality reviews and reconciliations to assess record completeness, accuracy, ownership, and status.
• Support Patch Oversight by reviewing patch-not-deployed rationale, overdue approvals, PTS data quality, and escalation requirements.
• Contribute to targeted reviews, control effectiveness assessments, issue analysis, and continuous improvement of the oversight model.
• Prepare clear, decision-oriented communications for leadership and governance forums.
• Mentor and support less experienced team members and promote consistent application of oversight practices.

What This Job Offers

• Job Type: Full-time
• Career Level: Senior