Sr Info Security Analyst

Wellstar Health System•VIRTUAL-TX, TX

23h•Onsite

About The Position

The Sr. Information Security Analyst functions as an information security subject matter expert supporting all aspects of WellStar with their knowledge and skills. The individual is experienced in many areas of the information security domains, and can conduct risk assessments, develop appropriate risk responses, and monitor the environment for change. The individual needs to have the capability to participate in several projects and tactical initiatives related to enterprise security, manage critical relationships with key stakeholders and vendors, drive process improvements for the information security program, and review risks assessments for potential security exposures. The Senior Analyst is also expected to mentor others interested in information security. The Sr. Information Security Analyst position reports directly to Mgt Information Security. Key responsibilities of the role include: This position will be responsible for monitoring and analyzing critical internal and external systems to ensure there are no misconfigurations with security standards and benchmarks that could lead to a compliance risk. Analyze management and technical controls to ensure that specific security and compliance requirements are met through the verification of documented processes, procedures and standards in order to validate maintenance of secure configurations. Perform CIS Benchmark assessments to analyze configurations and make recommendations for hardening configurations for Windows operating systems including servers, endpoints, VDI and thin clients. Identify and assess business and technology risks, controls which mitigate risks, and opportunities for control improvement. Analyze, report and track associated vulnerabilities to key stakeholders for remediation. Must be able to provide technical remediation details or workarounds, help track and identify asset inventory, log work tickets and exceptions and research vulnerability findings. Quickly respond and assess exposure and impact of zero-day vulnerabilities and provide management with briefings and course of action for mitigation. Must be able to provide management with security assessments and briefings to advise them of critical and high-risk findings that may impact WellStar operations and critical infrastructure. Identify and assess business and technology risks, internal controls which mitigate risks, and opportunities for internal control improvement. Assist with penetration testing when applicable. Experience with Rapid7 assessment tools - Rapid7 InsightVM and Insight Cloud Security preferred, CIS Benchmarking for endpoint, server and cloud infrastructure. Must be well versed in the Vulnerability Management Lifecycle Impact of this role in the organization is high. This position is important in helping to reduce loss and reputation associated with successful security breaches and resulting business disruption. If a security breach occurs, the costs of containment, recovery, public relations, and fines can quickly add up.

Requirements

Minimum 5 years in information security or a related field conducting security control assessments or audits Required
Rapid7 InsightVM and Insight Cloud Security, CIS Benchmark auditing tools for endpoint, server and cloud infrastructure.
Strategic planning and the development of supporting policies and procedures
Experience with information security principles, industry standards, and best practices
Technical lead/project leader experience in planning, implementing, and supporting enterprise information security solutions
Project management
Develop and manage key stakeholder relationships
Effectively coordinating work on multiple and diversified tasks while working with conflicting priorities and deadline
Ability to balance business requirements, patient safety and security risks
Ability to function with highly dynamic results-driven and high-pressure environment in order to achieve required objectives
Strong attention to detail and problem solving skills
Able to work independently and on a team
Creative thinking and ability to "think outside the box"
Knowledge of HIPAA Security Rule, PCI DSS and NIST CSF

Nice To Haves

Experience with Rapid7 assessment tools - Rapid7 InsightVM and Insight Cloud Security preferred

Responsibilities

Conduct security assessments: Test and monitor various systems and network components for vulnerabilities and misconfigurations that could lead to the compromise of Wellstars network. Test new toolsets to assist Wellstar in the vulnerability identification process.
Remediation: Assist with efforts related in remediating findings from vulnerability assessments, benchmarks and penetration tests. Provide risk-based mitigation strategies for networks, operating systems and applications including technical remediation steps. Prioritize vulnerabilities discovered along with expected remediation timelines. Inform various teams of active threats, zero-day vulnerabilities and exploits in the wild that can have a direct impact on Wellstar operations. Provide retesting services to validate remediation. Provide proof of exploitability for vulnerabilities found during the Vulnerability Management process, on an as needed basis. Provide actionable reporting so that Wellstar can remediate and mitigate risks discovered.
Process improvements and automation: Continue supporting current process automations for the Vulnerability Management program. Create new process automations for the Vulnerability Management program.
Security Research: Actively search for new vulnerabilities in systems and software. Report new findings through appropriate private disclosure methodologies. Monitor threat feeds for new emerging threats applicable to our environment. Performs other duties as assigned Complies with all WellStar Health System policies, standards of work, and code of conduct.