Security Specialist

The Security Analyst specializes in data loss prevention, protecting Terumo's data at every stage of its lifecycle and ensuring access is controlled according to the company's information security principles. Working alongside IT, Cybersecurity, Legal, Compliance, and other teams, this role identifies and reduces data loss risks, puts safeguards in place against insider threats and breaches, and verifies that security controls align with company policies and risk management standards.

When a data leakage event occurs or is suspected, the analyst partners closely with HR, Legal, and the affected business unit to investigate and resolve the situation.

Under broad supervision apply business insight and technical expertise within the area of information security for electronic and non-electronic means of storing, accessing, and exchanging information. Participate in a highly collaborative and diverse environment working closely with partners throughout the company and with the information-security professional community of practice.

• Serve as a key member of the Cybersecurity team, identifying, implementing, and maintaining data protection technical controls (DLP, data classification, data governance) across all Terumo business units and technology ecosystems, in line with business and compliance requirements.
• Collaborate with cross-functional teams and business units to understand their processes, plans, and risk tolerance, and to identify, assess, and mitigate data loss risks across the organization.
• Locate sensitive data to assess risk, document data protection policy exceptions, and periodically review them with business units.
• Monitor and investigate potential data loss incidents, including breaches, insider threats, and unauthorized data exfiltration.
• Recommend improvements that enforce least-privilege access and rigorous security practices while preserving user productivity and minimizing incentives to circumvent controls.
• Execute tactical requests that support the strategic vision for rigorous, scalable data protection controls.
• Stay current on emerging threats, adjusting DLP strategies and technologies accordingly.
• Perform analysis to assess potential and actual risks, threats, and vulnerabilities that pertain to the protection of company a) information that is proprietary, confidential and/or otherwise requires protection from unauthorized access, and b) electronic devices upon which the company or its associates rely, for business purposes, to be free from compromise in availability, reliability and security.
• Assess individual devices (servers, workstations, laptops, smartphones, network devices, etc.), departments, and network segments for security risks and standards compliance
• Understand and develop procedures to regulate access to computer data files and prevent unauthorized modification, destruction, and disclosure of information and maintain role-based access controls (RBAC).
• Work with service desk and development staffs to request programming changes. Plan data security for new or modified software, accommodating issues such as associate data access needs and risk of data loss or disclosure.
• Establish and maintain change and project management to support transition processes and constructing quality work plans and deliverables to meet communicated deadlines
• Research issues, problems or data security breaches and develop solutions to problems that are rare and unusually complex and creates new methods or processes
• Monitor security systems for potential incidents

• Experience with the architecture associated with a security operations center
• Experience with the implementation of encryption software
• Experience with security information and event management systems
• Experience implementing technical solutions in support of a defense-in-depth strategy
• Solution-oriented and analytical – comfortable navigating uncertainty, experimenting tactically to find a path forward, and breaking down complex data security issues to develop effective solutions.
• Data-driven – makes purposeful, timely decisions grounded in data.
• Customer-centric – responsive by nature, approaching all work with the end user's best interests in mind.
• Strong communication and interpersonal skills – conveys technical information clearly to both technical and non-technical audiences, anticipates others' information needs, adapts to different communication styles, and collaborates effectively with…