Information Security Analyst

• Five or more years of professional experience in application security, cloud security, product security, security engineering, or a closely related field.
• Bachelor's degree in cybersecurity, computer science, information systems, engineering, or a related field. A Certified Information Systems Security Professional (CISSP) credential, or a comparable security certification, together with relevant professional experience will be considered equivalent to the bachelor's degree requirement.
• Demonstrated experience defining security requirements and reviewing application architectures, data flows, integrations, and technical controls.

• Experience coordinating SAST, DAST, and penetration testing and validating remediation or retest evidence.
• Demonstrated experience performing risk analysis and vulnerability triage, developing remediation plans, implementing or supporting technical remediation, and tracking findings to closure.
• Experience implementing security controls and guiding agency or business personnel on control ownership, operation, evidence, exceptions, and ongoing management.
• Working familiarity with Jira, Salesforce-based applications, Tenable Cloud, Veracode static and dynamic testing, GitHub, and GitHub Copilot or comparable approved tools.
• Experience using AI-assisted capabilities responsibly for vulnerability testing, source-code or configuration review, finding analysis, or remediation planning.
• Working knowledge of identity, data protection, logging, deployment, cloud, and infrastructure controls for complex applications.
• Experience documenting security findings, residual risk, control decisions, and production-readiness recommendations.
• Experience coordinating security work across project teams, vendors, shared-service organizations, and managed security service providers.
• Ability to manage concurrent work against milestones, release schedules, acceptance criteria, and project reporting requirements.
• Excellent written and verbal communication skills, including the ability to explain technical risks to technical and non-technical stakeholders.
• Ability to work independently, maintain accurate evidence, and escalate risks or blockers promptly.