Sr Info Security Analyst

Farmers and Merchants Bank of Long Beach•Seal Beach, CA

1d•Onsite

About The Position

The Sr. Information Security Analyst designs, configures, administers, and monitors information security controls for the Bank. The role assists the CISO with risk assessment activities, selection and implementation of security controls, and documentation while executing the Information Security Program. It also supports incident response and may require after-hours support for production issues with security controls. The position includes scheduled on-call support for end users, with responsibility for meeting management-established response times and service levels. Security personnel must keep their cell phones available for support calls and outage alerts, and may be expected to respond to critical situations even when not scheduled for on-call duty. The role must comply with applicable state and federal banking laws, regulations, and internal policies, including requirements related to lending, operations, deposits, BSA, AML, OFAC, CIP, financial elder abuse reporting, sexual harassment prevention, information security, and privacy. This position is not eligible for an Officer Title. It is designated as a sensitive position requiring a mandatory two consecutive weeks of absence from essential duties each calendar year, scheduled in coordination with management. The work is primarily performed in an office environment with controlled temperature and standard office conditions. The position operates computers and customary office equipment. Physical demands include repetitive office and computer-based movements, sitting or standing for extended periods, handling objects weighing up to 25 pounds, and using hands and fingers to operate equipment. Reasonable accommodation is available as provided by applicable law.

Requirements

At least six years of applicable security and system administration experience.
Bachelor’s degree in computer science or equivalent.
Understanding of information security concepts and domains.
Experience administering Windows and Linux servers or network systems, including Arista, Cisco, or HP systems.
Understanding of or experience with firewalls, including Fortinet, web application firewalls, IDS/IPS, email encryption gateways, vulnerability scanning tools, and forensics tools.
Exposure to capturing and decoding logs or packets and recognizing attack signatures such as SQL injection and cross-site scripting.
Experience collaborating with vendors to implement security-related projects.
Strong understanding of Microsoft Active Directory access rights, user access provisioning, SQL access, and operating system security.
Working knowledge of Microsoft Azure, M365 cloud security, and Intune.
Knowledge of Ethernet, TCP/IP, DHCP, DNS, Active Directory, and enterprise-level backup software.
Experience with SIEM systems such as Sumo Logic or Splunk.
Effective verbal and written communication, including documenting activities, drafting reports, and presenting findings and recommendations.
Clear spoken and written English, customer service, time management, and project planning and execution skills.
Attention to detail, critical thinking, sound judgment, and problem-solving skills.
Ability to listen and learn, work independently and with people at all levels, communicate respectfully with supervisors and coworkers, and deal effectively with unpleasant, angry, or discourteous people.
Ability to perform repetitive office and computer-based movements, sit or stand for extended periods, lift, carry, or move objects up to 25 pounds, and operate standard office equipment, with or without reasonable accommodation.
Availability to complete a required two consecutive weeks of absence from essential duties each calendar year.

Nice To Haves

Security certifications from GIAC, ISC2, or CompTIA, such as CISSP, SSCP, CCSP, GCIH, or CEH.
Microsoft cloud certifications, such as Microsoft Certified: Azure Security Engineer Associate or Microsoft Certified: Cybersecurity Architect Expert.
Penetration testing experience.

Responsibilities

Select, design, configure, administer, and monitor security controls, maintaining the reliability, performance, and availability of systems.
Contribute to IT and information security risk assessment documentation using knowledge of relevant risks and controls.
Research and develop security technologies to assess, monitor, or reduce enterprise vulnerabilities.
Automate security activities and data analysis through scripting and data management, including Python, PERL, and PowerShell.
Document work activities in activity logs, periodic reports, problem and change management systems, project tracking systems, and similar systems.
Document system design and configuration information accurately and in accordance with business writing standards.
Follow Change Management procedures and minimize production disruption through sound judgment and due care.
Administer security-related MS SQL databases.
When scheduled for on-call duty, provide after-hours end-user support and meet management-established response times and service levels.
Keep cell phones available for end-user support calls or outage alerts and respond to critical situations when required, including when not scheduled for on-call duty.
Assist with incident response and support production issues involving security controls.
Comply with applicable banking laws, regulations, and internal policies, including BSA, AML, OFAC, CIP, privacy, and information security requirements.