Risk and Security Analyst- Onsite

GCEFCU is seeking a Risk and Security Analyst to join our IT department! The Risk and Security Analyst is responsible for leading and administering the Credit Unions cyber and information security risk management program. This position develops, implements, monitors, and continually improves security controls, policies, standards, technologies, and response capabilities designed to protect the confidentiality, integrity, and availability of Credit Union information and systems.

This position is located onsite at our Pasadena location.

Security operations and engineering:
Oversee the implementation, configuration, monitoring, maintenance, and effectiveness of information security technologies, including firewalls, endpoint security, email security, encryption, network detection and prevention, security monitoring, and other preventive and detective controls. Coordinate with internal IT teams and service providers to address identified security events and control deficiencies.

Manage the vulnerability and exposure management program, including vulnerability scanning, penetration testing, configuration assessments, tracking of remediation activities, validation of corrective actions, risk acceptance documentation, and reporting of unresolved exposures.

Lead or coordinate the investigation, containment, eradication, recovery, documentation, and post-incident review of cybersecurity incidents. Maintain incident response procedures, escalation paths, communication protocols, evidence-handling practices, and relationships with internal and external response resources. Participate in periodic incident response exercises. Notify relevant stakeholders within timely manner.

Maintain and continually improve the Credit Unions information security governance and risk management program. Conduct or coordinate cybersecurity risk assessments, monitor security control effectiveness, support regulatory examinations and audits, maintain evidence of compliance, track corrective actions, and provide security risk reporting to management.

Assess cybersecurity risks associated with applicable third-party relationships. Review security documentation, risk assessments, contractual security requirements, incident notification provisions, remediation plans, and ongoing monitoring results in coordination with Vendor Management, Compliance, Legal, and business owners.

Provide security oversight of identity and access management controls, including privileged access, multifactor authentication, access reviews, segregation of duties, authentication standards, and timely removal or modification of access.

Develop, maintain, communicate, and support enforcement of information security policies, standards, procedures, and employee security awareness initiatives. Provide targeted education based on emerging threats, incidents, testing results, and organizational risk.

Responsible for compliance with Bank Secrecy Act and all governmental regulations and Credit Union policies and guidelines. Responsible for complying with Federal Rules and Regulations as required by NCUA.

Performs other job-related duties as assigned.

EOE Disabled/Veteran