Vulnerability Identification Analyst

Bank of America • Denver, CO

21h

About The Position

The Vulnerability Identification Analyst is an individual contributor on Bank of America’s GIS Vulnerability Identification Assurance (VIA) Vulnerability Identification team. The role analyzes, improves, implements, and executes security controls to help protect company information and systems from external threats. It helps implement, manage, and monitor infrastructure vulnerability identification efforts to protect the confidentiality, integrity, and availability of business information assets.

The analyst establishes processes and controls using Tanium to monitor CVE-based vulnerabilities and associated risk on technology that lacks GIS tools or effective automated-scanning signatures. The position works with stakeholders, Product Owners, and Software Engineers on data requirements, quality-control performance, research, and troubleshooting. It also supports technology-based identification and quality-control expansion, including coverage for workstation and ATM vulnerabilities supplied by non-GIS teams. Occasional weekend coverage is required. This is a first-shift role with 40 hours per week. Bank of America describes an in-office culture with flexibility based on role responsibilities and business needs; the listed locations are Denver, Colorado; Washington, D.C.; and Chicago, Illinois.

Requirements

• 3–5+ years of experience in information security and/or data management roles.
• 3–5+ years of experience with vulnerability management and/or assessment.
• Experience with CVE vulnerability analytics as a focus area within information security.
• Strong experience with CVE-based vulnerability identification and risk analysis.
• Ability to validate and analyze scan data returned by enterprise toolsets.
• Ability to review and analyze quality-control data to determine overall risk.
• Ability to approach difficult problems creatively and provide viable solutions for enterprise risk visibility and reduction.
• Good communication skills and ability to translate technical cybersecurity threats into business-line understanding and execution, communicate risks, and propose countermeasures to senior technology executives.
• Ability to explain analytics in plain English and communicate associated risk.
• Ability to see the broader organizational picture, build consensus, and drive results.
• Ability to work independently with little oversight, self-direct, and achieve assigned goals.
• Ability to work in a changing, fast-paced environment; motivated and willing to learn.
• Ability to identify and develop proposals for program improvement.
• Broad technical background using security technologies, including server and workstation operating systems, network security, vulnerability scanning engines, and compliance management solutions.
• Strong PC and data-management skills, including Microsoft Office applications such as Excel.
• Occasional weekend coverage is required.

Nice To Haves

• Bachelor’s and/or master’s degree in Computer Science, Information Technology, or a related field.
• Strong analytical, problem-solving, and conceptual-thinking skills.
• Ability to communicate effectively with technical and non-technical business owners.
• Experience assisting with internal efficiency projects and development.

Responsibilities

• Discover and analyze CVE-based vulnerability findings and route them to reporting workstreams.
• Perform targeted quality control on reported vulnerabilities and on the scope of the inventory being assessed.
• Review existing Tanium vulnerability-detection processes and identify ways to streamline and improve efficiency.
• Respond to stakeholder requests to investigate potential technology-based identification or reporting issues.
• Lead effective and sustainable activities associated with required VAI quality-control technology-based identification P2 closure evaluations.
• Support expansion of technology-based identification activities for GIS.
• Support expansion of quality-control coverage for workstation and ATM vulnerabilities currently fed by non-GIS teams.
• Perform other related duties and special assignments as needed or assigned.

Benefits

• Benefits eligibility.
• Access to paid time off.
• Resources and support for employee well-being and impact.
• Eligibility to participate in the annual discretionary incentive plan, with awards based on individual performance and behavior, business contributions, and overall company success.

What This Job Offers

• Job Type: Full-time
• Career Level: Mid Level
• Education Level: No Education Listed