Senior Information Security Analyst

Job Details:

Job Location:

Culver City, CA 90230, Position Type:
Full Time, Salary Range: $ - $ Salary/year, General Statement of Job:

The Senior Information Security Analyst is a senior individual contributor responsible for advancing SIS's information security program and for leading the company's effort to achieve and maintain ISO 27001 certification. This individual owns the day-to-day operation of the Information Security Management System (ISMS)—risk assessment, control implementation, policy development, internal audit readiness, and evidence collection—and serves as the primary respondent to client cyber security surveys, questionnaires, and third-party assessments.

The role is measured by steady, incremental progress against SIS's published security objectives across the cloud, identity, endpoint, and network environment, as well as the physical security technologies deployed at SIS offices and at client sites monitored by the Fusion Center. SIS operates a predominantly Apple environment (approximately 90% macOS) supporting a 24/7 Global Security Operations Center. The Senior Information Security Analyst works within an ITIL-based operational framework and reports directly to the Director of Technology.

• Design and maintain security reference architectures and technical security standards across the cloud, identity, endpoint, network, application, and physical security domains, and review proposed designs and infrastructure changes against them (15%)
• Administer, tune, and monitor security tooling in partnership with the Senior Cloud Administrator, including endpoint detection and response (Sentinel One), vulnerability management, email security, data protection, and a Security Information and Event Management (SIEM) solution, ensuring alerts are actionable and triaged (10%)
• Own vulnerability management and remediation across endpoints, infrastructure, and cloud services, including patch currency, device encryption, configuration hardening, and periodic least-privilege access reviews (10%)
• Build and automate security operations through scripting and platform integration, including continuous control monitoring, automated evidence collection, access review workflows, and alert enrichment, reducing reliance on manual, point-in-time compliance effort (10%)
• Support security incident response, including investigation, containment coordination, documentation, root cause analysis, and post-incident reporting, working closely with IT Infrastructure and Fusion Center leadership (5%)
• Conduct security reviews of enterprise business applications, including Salesforce, Sage Intacct, the enterprise workforce management platform, and internally developed applications, covering role and permission models, segregation of duties, data sharing and export controls, API and integration credentials, audit logging, and data retention (5%)
• Establish secure development and application security requirements for custom and client-facing applications, including secure coding standards, dependency and vulnerability scanning, penetration testing cadence, and remediation tracking with internal development and vendor teams (5%)
• Drive onboarding of enterprise applications to centralized identity, including Single Sign-On and automated provisioning, and conduct periodic application-level access reviews and offboarding validation (2%)
• Contribute information security and technical expertise to the standards and longer-term strategy for physical security technologies in use at SIS offices and at client sites monitored by the Fusion Center, including video management and camera platforms, access control and badge systems, and emerging AI-based detection and video analytics capabilities, in partnership with the Director of Technology, Fusion Center leadership, and other system owners (5%)
• Ensure physical security systems are deployed and maintained in line with information security requirements, including network segmentation, device hardening, credential and certificate management, firmware currency, centralized logging, and data retention and privacy obligations (5%)
• Perform security review of new technologies, vendors, and contracts, including third-party risk assessment and review of security exhibits and data protection terms (3%)
• Lead SIS's ISO 27001 certification effort end to end, including scoping and the Statement of Applicability, gap assessment against Annex A controls, hands-on implementation and configuration of the…