Senior Security Analyst, Sertifi

• 5+ years of experience in IT Security Ops and/or GRC (Governance Risk and Compliance) ops; 8+ years of experience in lieu of an advanced degree from an accredited 4-year college or university
• Experience with IT governance, risk, and compliance management
• Experience with PCI, SOC1/2 Type 2 Audits, and related processes
• Experience writing policies, procedures, and controls in one or more standards/frameworks
• Ability to properly handle confidential data and strictly follow business process and procedures
• Deep understanding of security and analytical concepts, incident response and incident management methodologies, and IT security tools and controls
• Excellent report writing skills, ability to prepare reports and associated metrics
• Effective communication skills, and the ability to explain security best practices to a non-technical audience
• You are collaborative and with an enterprise mindset, you speak up and welcome all input, opinions, and questions

Desirable

• We are currently seeking a Senior Security Analyst who can work cross-functionally demonstrating strong stakeholder engagement and communication skills, strong analytical and problem-solving skills, and the ability to respond to challenges and setbacks in an agile and resilient manner
• This role functions as a security expert in many different spaces of security, leading projects and efforts to implement or improve the existing security posture of Sertifi
• This position will report into our Director of IT Operations and Security
• Responsible for maintaining our phishing simulation exercises from the creation of templates to the remedial training assigned and the presentation of results to senior management
• Own the continuous effort of spreading general security awareness across the organization and training developers on coding best practices through various learning modalities
• Creating/maintaining SOPS/Runbooks across our various security tools for consistency when triaging alerts
• Maintain and fine tune our security tools to reduce the noise and eliminate false positives to optimize time spent reviewing alerts
• Create reports on key security metrics to report to company stakeholders
• Assist in monitoring, analyzing, and responding to security alerts and events to identify potential security incidents or breaches (e.g. Reported phishing emails, Defender/SIEM alerts)
• Support all aspects of Information Security Data Privacy policies, standards, and processes as it relates to certification and compliance requirements
• Identify and analyze new requirements for policy impacts; develop and update policies, procedures and guidelines
• Designing and Implementing SOAR best practices for the business
• Remediate control gaps as noted through internal risk assessments and external audit activities
• Owns the ongoing compliance, evidence collection, and all processes, including annual audits
• Perform Vendor Risk Assessments
• Be the primary point of security risk management activities, including analyzing, quantifying, and tracking identified information security risks and reviewing and documenting risk exception requests
• Supports vulnerability management and responds to vulnerability reports for applicability, while taking remedial actions
• Provide security expertise and advice to other teams within the company
• Identify, analyze, and interpret trends or patterns in complex data sets