IT Security Analyst

Job Description

St. Mary's Credit Union is currently hiring a IT Security Analyst role. This is a hybrid position based at our main office in Marlborough, MA

If you are looking to join a great place to work that is growing, progressive, offers development opportunities, has an awesome team, and outstanding benefits, we want to hear from you!

The IT Security Analyst is a hands-on member of the Credit Union's Information Technology team responsible for operating core security and compliance processes. Working with and receiving day-to-day guidance from the Senior IT Security Analyst, this role manages security scanning and remediation tracking, supports the investigation and response to security events and incidents, and administers security access changes and related workflows.

The analyst also supports compliance activities, audit and risk assessment remediation, security documentation, control testing, and reporting. The successful candidate will bring practical IT security experience, strong process discipline, and the ability to coordinate work across IT, business units, and third-party providers in a regulated financial-services environment.

Performs functions within the scope of authority and expertise to provide a high level of service and responsiveness to the members and employees served by the Credit Union.

• Operate and monitor approved vulnerability scanning tools across servers, workstations, network devices, applications, and other in-scope technology assets.
• Review and validate scan results; assess severity and business relevance; create, assign, track, and follow up on remediation activities through closure.
• Coordinate with IT administrators, system owners, vendors, and independent testers to address vulnerabilities, configuration weaknesses, and security findings.
• Maintain accurate vulnerability records, exceptions, evidence, aging information, and management reporting.
• Monitor alerts and logs from security systems such as firewalls, endpoint protection, SIEM, identity platforms, email security, IDS/IPS, web filtering, and Microsoft security tools.
• Support secure configuration and system-hardening activities for endpoints, servers, cloud services, network equipment, and business applications.

• Triage, investigate, document, elevate, and track security alerts, events, and suspected incidents in accordance with established procedures.
• Collect and preserve relevant evidence; coordinate containment, remediation, recovery, and follow up activities with the Senior IT Security Analyst, CIO, IT staff, business owners, and external providers.
• Maintain incident tickets, timelines, decisions, communications, and supporting documentation sufficient for management, audit, regulatory, and lessons-learned purposes.
• Participate in incident response exercises, tabletop activities, and post-incident reviews; help translate lessons learned into practical control and process improvements.
• Support third-party security incident intake and tracking, including requests for information, impact analysis, and documentation of follow-up actions.

• Process and coordinate authorized user access requests, changes, removals, and periodic access reviews in accordance with least-privilege and segregation-of-duties principles.
• Administer or coordinate security access workflows for employee onboarding, role changes, transfers, terminations, elevated access, shared accounts, service accounts, and vendor access.
• Validate required approvals and supporting information before changes are completed; retain clear evidence of request, approval, implementation, and verification.
• Identify incomplete, conflicting, excessive, or aging access and workflow items, and elevate exceptions or control concerns promptly.
• Work with IT and business owners to improve the consistency, automation, documentation, and reporting of access-management workflows.

• Assist with operation and documentation of controls aligned with the Credit Union's Information Security Program, selected security framework, policies, and regulatory expectations.
• Gather, organize, and retain evidence for audits, risk assessments, control testing, regulatory reviews, penetration testing, and independent security assessments.
• Track findings, management responses, action plans, due…