IT Risk Analyst II

This position may be located at any of First Interstate Bank's offices in Idaho, Iowa, Missouri, Montana, Nebraska, Oregon, South Dakota, or Wyoming.

The IT Risk Analyst II is responsible for measuring and identifying technical risks within First Interstate Bank's infrastructure and third-party solutions. The role includes testing to validate security configurations, leveraging risk metrics and dashboards to assess and report on technical risk, and providing guidance on IT security architecture and configurations based on evaluated risks and controls.

• Leverage technical knowledge to develop and enhance cyber and information security policies, procedures, and standards.
• Collaborate with Enterprise Architecture to develop and enhance information security architecture standards and IT security technology roadmaps.
• Research and evaluate proposed new technologies and platforms to ensure appropriate technical security controls are specified and aligned with the security reference architecture.
• Provide security consulting on projects to ensure solutions are designed per security architecture and configurations are properly implemented.
• Perform technical security assessments against FIB’s existing infrastructure and products to ensure compliance with security architecture, policies, standards, procedures, and industry best practices.
• Monitor and mature risk-based IT security metrics, scorecards, and dashboards to track cybersecurity performance and trends across the organization.
• Assist the business in identifying root causes and developing mitigation for deficiencies.
• Work with various groups during product upgrades or new product design to ensure security best practices are implemented.
• Perform technical reviews of third-party cyber and information risk.
• Research emerging technologies to support security enhancement and development efforts.

• Knowledge of concepts and principles in information security functional areas (cloud security, firewalls, identity and access management, industry standard security frameworks, security controls, compliance frameworks).
• Strong oral, written, and interpersonal communication skills to interface with managers and staff at all levels.
• Ability to remain up to date with emerging threats, best practices, and relevant frameworks, guidance, and legislation.
• Capacity to manage varied assignments and work independently.
• Ability to define problems, collect data, establish facts, and draw valid conclusions.
• Ability to interpret a wide variety of technical instructions in mathematical or diagram form and handle several abstract and concrete variables.
• Experience with risk analysis and assessment methods and measuring cybersecurity compliance.
• Experience maintaining and updating documentation (policies, standards, patterns, reference architectures) that support security environments.
• Experience with compliance and regulatory program requirements.

• Bachelor's Degree in a related field (required).
• 4-6 years of experience in IT security audit, architecture, engineering, risk monitoring, and/or equivalent combination of education and experience (required).

• CISSP – Certified Information Systems Security Professional
• CISA – Certified Information Systems Auditor
• CEH – Certified Ethical Hacker
• CCSP – Certified Cloud Security Professional
• GSEC – GIAC Security Essentials Certification
• GISP – GIAC Information Security Professional

• Dexterity of hands/fingers to operate computer keyboard and mouse – Frequently.
• Lifting – Occasionally (up to 50 lbs).
• Sitting – Frequently.
• Standing – Occasionally.
• Noise Level – Moderate.
• Typical Work Hours – M-F (8-5).
• Regular and Predictable Attendance – Required.

Reasonable accommodations may be made to enable individuals with disabilities to perform the essential functions of the job.