Information Security Risk and Compliance Analyst

Position Summary

The Information Security Risk and Compliance Analyst is a member of the Compliance and Risk Management team, working under the Information Security Officer and Assistant Risk Manager with strong collaboration with the Information Technology Security department. The analyst monitors key system access changes, configurations, and controls to ensure compliance with policy and best practices, oversees the process for employee reporting of suspicious e‑mails, manages the bank’s social engineering and phishing testing program, provides user security training and awareness, performs IS risk assessments, and supports review of security control effectiveness.

The role requires independent decision making on matters of moderate complexity and appropriate discretion in handling confidential information.

• Monitor key system access changes, configurations, and other access controls and advise IT personnel and business management on access policies and best practices.
• Oversee the process for researching and responding to employee and consumer reported suspicious e‑mails and assist with phishing e‑mail escalation and handling.
• Maintain the bank’s phishing email platform and plan, perform, and monitor social engineering and phishing exercises, including coordination with third‑party provider and maintenance of internal phishing platform.
• Report exercise results to management and manage the bank’s security awareness training program, including developing training and awareness content, communicating with users in writing and verbally, and performing new employee training presentations.
• Perform IS risk assessments, such as GLBA‑required information security assessments and electronic banking risk assessment, and other reviews of security control effectiveness.
• Work directly with IT and business management to assess and advise on IS risks and controls and participate in proactive team efforts to achieve departmental and company goals.
• Perform other duties as assigned and comply with current applicable laws, regulations, and bank policies and procedures.

• At least 5 years of related experience, preferably within IT audit, governance, risk, or compliance domains.
• Additional industry certification related to information security or cybersecurity required (preferably CISM, CISA, or CRISC).
• Working knowledge of IS and cybersecurity best practices, risks, and controls is imperative.
• Excellent analytical and organizational skills with strong observational skills and attention to detail.
• Strong written and verbal communication skills with ability to work with wide variety of audiences.
• Must have experience with Microsoft Office and similar applications; intermediate Microsoft Excel experience required and Microsoft VBA knowledge preferred.
• A significant level of trust and diplomacy is required to be an effective subject matter expert in the position and to handle sensitive and highly confidential information.

• Customer Service
• Communication Skills
• Integrity and Professionalism
• Problem Solving
• Attention to Detail
• Team Collaboration
• Unconditional Ethics

• Competitive compensation and retirement and savings plans.
• Flexible Spending Accounts and paid time off and holidays.
• Employee Assistance Program and health, dental, life and disability coverage.
• Parental leave and professional development opportunities.
• Career advancement pathways.

Cap Fed® is an equal opportunity employer.