Corporate Information Security Risk & Vulnerability Analyst

Responsibilities

• Vulnerability Management Support – Assist in scanning, identifying and tracking vulnerabilities, analyze scan results, document findings and follow up with IT to ensure remediation aligns with security policy and SLAs.
• Risk Acceptance Support – Track and document vulnerability and configuration exceptions, audit findings and policy deviations, verify false positives and maintain exception records through their lifecycle.
• CIS CSAT Support – Administrate the CIS Critical Security Controls Self‑Assessment Tool, gather evidence, track assessment progress and support control improvement planning.
• Security Risk & Compliance Support – Track remediation progression for open vulnerabilities, risk exceptions and audit items; prepare status updates and monitor compliance timelines.
• Metrics & Reporting – Maintain spreadsheets, dashboards and other reporting tools summarizing key risk indicators, scan results and remediation trends; assist with preparing reports for management review.

• Education –
  
  Required:
  
  High School Diploma or GED. Preferred:
  Bachelor's Degree in Information Technology (preferably Information Assurance or Information Security) or related field.
• Experience –
  
  Required:
  
  1 year hands‑on experience with vulnerability scanning tools such as Qualys, Tenable or Rapid7; 1 year experience supporting vulnerability management programs in regulated industries; beginner level experience collaborating with IT teams for timely patching; beginner level experience with regulatory compliance frameworks (CIS, NIST, ISO 27001); beginner level experience developing and presenting security reports, dashboards and metrics to leadership.
• Preferred: 1 year experience conducting security risk assessments and providing mitigation recommendations.
• License/Certification –
  
  Required:
  
  One entry‑level certification such as CompTIA Security+ or GIAC Security Essentials (GSEC). Preferred: GIAC Critical Controls Certification (GCCC) or one or more advanced certifications such as CISSP, CISM, CISA, CRISC, CGRC.

• Vulnerability Management & Risk Analysis – Proficiency with scanning tools (Qualys, Nessus), CVSS scoring, Tru Risk, QDS and remediation tracking.
• Security Frameworks & Compliance – Knowledge of CIS Controls, NIST 800‑53, FFIEC and regulatory requirements for financial institutions.
• Patch & Remediation Coordination – Experience working with IT teams to implement security patches and mitigate risks.
• Threat Intelligence & Risk Assessment – Ability to analyze emerging threats, assess business impact and prioritize vulnerabilities accordingly.
• Reporting & Metrics – Strong skills in interpreting scan results, generating executive reports and tracking key risk indicators (KRIs).
• Cross‑Team Collaboration – Work effectively with IT, development, compliance and vendors to ensure vulnerabilities are addressed.
• Security Awareness & Training – Educate teams on secure configurations and vulnerability mitigation best practices.
• Policy & Procedure Development – Ability to draft and maintain security policies, standards and guidelines.
• Project Management & Organization – Track multiple remediation efforts, meet SLAs and ensure timely risk resolution.
• Communication & Leadership – Clearly convey technical security risks to non‑technical stakeholders and support continuous program improvements.
• Employee must be capable of regular, reliable, and timely attendance.

Travel:
Occasional travel required (less than 10 days per year) by automobile, commercial airlines, rental vehicles and public transportation.

Working Conditions – Indoors, climate‑controlled shared work area; moderate noise; sedentary work with occasional lifting up to 10 pounds.

Vision – Close visual acuity to prepare and analyze data, view a computer terminal and read printed or handwritten materials.

Starting salary is dependent on relevant experience and location. We offer an extensive benefits package that includes medical, dental, vision, and life insurance; health savings account; employee assistance program; health rewards; retirement savings plan (401(k) and profit‑sharing); short and long‑term disability;…