Description
Position Summary
The position is responsible for conducting second-line testing in accordance with the 3-Lines of Defense operating model and a layered defense-in-depth information security (IS) architecture. As part of the Information Security Program Assurance team, the assurance analyst is ultimately concerned with ensuring risk and controls are effectively managed.
In that capacity, the incumbent is responsible for testing, analyzing, measuring, and documenting the overall effectiveness of information security and cybersecurity controls in accordance with established policies, procedures, and the Information Security Program in general. This position is primarily responsible for conducting security controls testing, monitoring, and reporting. In addition, the position will work towards automating existing controls as needed.
Essential Job Functions
- Collaborate with Information Technology (IT) to execute comprehensive IT control testing using established Key Performance Indicators (KPI) and Key Risk Indicators (KRI)
- Verify the confidentiality, integrity, and availability of data and technology through assessments and control frameworks
- Contribute to periodic information security and cybersecurity risk assessments, information security controls self-assessments, control tests, and reviews to ensure control effectiveness
- Coordinate with IT leaders, IT managers, IT individual contributors, and appropriate risk personnel on periodic risk and vulnerability assessments. Identity control gaps and opportunities for control enhancement and control enrichment
- Coordinate with Information Security Operations and IT as needed to prepare control metrics (operational and functional), and to enhance control coverage and effectiveness
- Participate in identifying and implementing tools, technologies, processes, and procedures to enhance the information security and cybersecurity controls testing, and monitoring programs
- Exhibit a strong understanding of Information Security Operations, Architecture and dependent disciplines including Systems and Processes, Change Management, Databases, Business Continuity and Applications Controls
- Automate control testing where possible
- Design additional control tests
- Function as an additional resource for threat intelligence, as needed
- Perform other duties as assigned
Position Requirements
- Bachelor’s Degree in Information Technology, Information Security, Information Assurance, Management of Information Systems, or similar discipline
- 3+ years of Information Technology (IT) experience or Information Security (IS) experience. Hands on experience is critical.
- Knowledge of information security controls and technology, particularly endpoint detection and response (EDR), log management, and identity and access management
- Possess excellent written and verbal communication skills and be capable of interacting with all levels of management, with specific concentration on writing assessments and test reports
- Ability to manage priorities and work independently
- Exceptional analytical and problem-solving skills
- Works autonomously with minimal direction; motivated and self-driven
- Develop and foster working relationships
- Strong planning, organization, and documentation skills
- Strong attention to detail
Preferred
- Coding and/or scripting knowledge/experience. Knowledge of Python and/or APIs is a plus. Experience automating repetitive tasks is a strong plus
- Experience with multiple security controls
- Experience with Information Security controls testing platforms (AttackIQ, Verodin, etc.)
- Compliance background/knowledge with Federal compliance and examination requirements, preferably in Financial Services
- Knowledge of Payment Card Industry Data Security Standards (PCI-DSS)
- Familiar with basic auditing principles
- Security certification a strong plus (Security +, CISA, GSEC, etc.)
- Knowledge of NIST 800-53 and 800-37 Rev 2
- Knowledge in cloud security
- Knowledge in Application Security and the Software Development Life Cycle (SDLC)
- Threat Intel Platform (TIP) experience
- MITRE ATT&CK Framework experience
- Open Source Intelligence (OSINT) experience
Credit One Bank, N.A. is a data-driven financial services company based in Las Vegas. Founded in 1984, Credit One Bank offers a spectrum of credit card products for people in all stages of financial life. Credit One Bank is an equal opportunity employer committed to diversity and inclusion and does not discriminate against any employee or applicant for employment because of age, race, religion, color, disability, sex, sexual orientation, or national origin. Reasonable accommodations can be made for those who require them, including access to job applications and workplace accommodations. Employment at Credit One Bank is based on mutual consent (also known as at-will). This means that employees and the Bank may terminate the employment relationship at any time, with or without cause and with or without notice. Please contact the recruiter for this position to learn more. Credit One Bank does not accept unsolicited resumes from agencies and is not responsible for related fees.