Security GRC Analyst

Job Overview

The Security GRC Analyst role is to ensure the secure operation of the Credit Union’s computer systems, servers, and network connections. The role will primarily be responsible for the assessment of technology risk, including third party risk, developing remediation plans, and tracking to completion, enforcement of the network security policy, and compliance with requirements and recommendations of security audits and assessments.

The incumbent will also be expected to make suggestions for hardware, software and policy changes that will improve the security posture of the organization.

• Assess technology risk across IT and the organization, collaborate to develop remediation plans, and track initiatives to completion. Perform control gap assessments, communicate and track findings, and initiate plans for remediation.
• Assess third party risk, work with the business unit and vendor to communicate risk and determine action plans, and track initiatives to completion.
• Act as a security resource for projects in support of the business throughout the year. Communicate with IT Security team to clearly identify all required technical tasks and time requirements for each project to assist with determining a realistic estimated completion date. Ensure that technology risk is identified for new products and that systems are implemented in the most secure manner possible.
• Participate in all internal and external audits, guaranteeing that all security related documentation and materials are accurate, current and readily available. Ensure prompt and thorough response to and remediation of all findings and recommendations.
• Participate in all internal and external security assessments, guaranteeing that all security related documentation and materials are accurate, current and readily available and that the proactive testing is non-intrusive to maintain daily business operations. Manage prompt and thorough response to and remediation of all findings and recommendations.
• Support and contribute to the organization’s security programs and help ensure that the team appropriately follows all incident response procedures when needed.
• Participate in regular vulnerability assessments of the infrastructure and follow up on and respond to or implement the remediation actions for all findings and recommendations.
• Evaluate the security of the infrastructure and identify areas for improvement. Suggest action plans that will increase the security posture of the organization without limiting or hindering required functionality.
• Develop or review and regularly enhance system hardening procedures for all infrastructure equipment based on industry standards.
• Take an active role in managing vendor relationships and analyzing internal processes to reduce expenses and/or increase efficiencies in support of continuous improvement. Assist with research of expenses and preparation of annual budgets and ensure accuracy when processing any assigned invoices.
• Look for opportunities to work more proactively and less reactively with a goal of continuous improvement. Identify ways in which to better monitor and/or improve the security of all systems and applications in order to increase system and application stability and up-time.
• Create and maintain Information Security Policies as directed. Ensure that written procedures are documented for all assigned functions and remain current.
• Participate effectively and efficiently when assigned tasks in support of disaster recovery exercises.
• Continually work on developing a full understanding of the LAN/WAN and Infrastructure.
• Must keep professional skills up to date and consistent with current technology.
• Must be a high energy individual who can multi-task and work well in stressful situations.
• Must be technically oriented and have excellent analytical, organizational and communication skills.
• Perform additional duties as assigned.

• Minimum of three years of IT Security or technology risk experience required;
  Banking experience preferred.
• Bachelor’s Degree in related field required. Three years demonstrated technical experience may be…