A bachelor's degree in Business, Computer Science, Management Information Systems, or a related field; five years of relevant experience may substitute for the degree.
A minimum of five years of IT security experience with complex system technology.
Advanced knowledge of at least one common information security management framework, such as HIPAA, HITRUST, ISO/IEC 27001, ITIL, NIST, COBIT, or ITL.
Strong critical-thinking, analytical, and problem-sensitivity skills; detail orientation and ingenuity.
Project management skills, communication skills, and the ability to build collaborative relationships.
Proficiency in five security components for the Senior level.
Responsibilities
Provide guidance and policy expertise for data security, including data classification, storage, transmission, and lifecycle; set baseline configurations, monitor data governance, and set and enforce security standards for file permissions, encryption, cloud data security, network assets, and endpoint requirements.
Provide and support network monitoring solutions within SOC/SIEM implementation, handle initial incident response, consult on communications and network security, and oversee implementation, configuration, maintenance, and changes to network security capabilities and assets.
Manage account security and controls across account security systems; review and approve privileged-access entitlements; conduct usage audits; verify removal of retired accounts; approve launcher requests; provide end-user support; create, modify, delete, and retire member accounts; manage role entitlements; maintain Workday integration; and manage access-management application and system updates and testing.
Advise business partners on information-security issues and risks; create, manage, and enforce information-security policy; oversee framework compliance; manage enterprise audit remediation and CAP management, vulnerability management, anti-phishing campaigns, security awareness and training, and third-party risk management.
Ensure information security design addresses confidentiality, integrity, and access; set security requirements; ensure system redundancy and fault tolerance; set standards for mobile and web security; and ensure IoT device security.
Provide requested evidence and artifacts for security assessments and audits; coordinate and schedule enterprise security assessments; and coordinate and ensure the quality of vendor-provided security assessments, risk assessments, and penetration testing of enterprise assets.
Apply information-security concepts, techniques, and best practices to support incident-response plans and capabilities; conduct and support investigations, logging, and monitoring; securely provision resources; test disaster-recovery plans; and address personnel safety and security concerns.
Provide technical consultation for software development security; oversee static and dynamic scanning of internally developed software and report findings to ensure remediation of code vulnerabilities; and review SDLC documentation for compliance with company and regulatory standards.
Perform other duties as assigned.
Desired Qualifications
A professional security-management certification such as HITRUST CCSFP, CISSP, CISM, CISA, or a similar credential.
System analysis experience.
Project management experience.
Data testing and/or software application testing experience.
To learn more about Arkansas Blue Cross and Blue Shield Hiring Policies, please click here.
Job Summary
The Information Security Analyst is responsible for the operations, administration, and governance of the enterprise security solutions and processes.
Requirements
EDUCATION
Bachelor’s degree in Business, Computer Science, Management Information Systems, or related field. In lieu of degree, five (5) years’ relevant experience will be considered.
LICENSING/CERTIFICATION
Professional security management certification, such as a HITRUST certification (CCSFP), Certified Information Systems Security Professional (CISSP), Certified Information Security Manager (CISM), Certified Information Systems Auditor (CISA) or other similar credentials preferred.
EXPERIENCE
Minimum five (5) years' IT security experience with a complex system technology.
Advance knowledge of at least one (1) common information security management framework, such as HIPAA, HITRUST, ISO/IEC 27001, ITIL, NIST, COBIT, and/or ITL.
System analysis experience preferred.
Project management experience preferred.
Data testing and/or software application testing preferred.
ESSENTIAL SKILLS & ABILITIES
Detail-Oriented
Critical thinking
Strong analytical skills
Problem sensitivity
Ingenuity
Project management skills
Excellent communication skills
Ability to build collaborative relationships
LOCATION
This is a hybrid role in our Little Rock, AR, location, requiring a minimum of three days in office weekly.
Skills
• Active Listening
• Business Compliance
• Computer Literacy
• Coordinating Resources
• Critical Thinking
• Deductive Reasoning
• Interpersonal Relationship Management
• Operations Coordination
• Oral Communications
• Problem Sensitivity
• Process Improvements
• Systems Analysis
• Time Management
• Written Communication
Responsibilities
• Asset Security: Provides guidance and policy expertise for data security, specifically regarding data classification, data storage, data transmission, and data lifecycle. Sets baseline configurations and monitors data governance. Sets policy and enforcement on security standards, such as file permissions, encryption, cloud data security, network assets, endpoint requirements, and others.
• Communications and Network Security: Provides/supports network monitoring solutions within SOC/SIEM implementation. Handles initial incident response functions. Provides limited consultation to support elements within this domain. Oversees implementation, configuration, maintenance, and changes for all network security capabilities and assets.
• Identity and Access Management: Provides account security management and control across all account security systems. Manages privileged access management entitlement review/approvals. Conducts usage audits, verifies removal and retired accounts, approves launcher requests, and provides end user support. Creates, modifies, deletes, and retires member accounts. Manages role entitlement process. Maintains Workday integration. Manages access management application/system updates and testing.
• Peforms other duties as assigned.
• Security & Risk Management: Provides guidance to business partners for all information security-related issues and identified security risks. Creates, manages, and enforces information security policy. Provides oversight of framework compliance. Manages enterprise audit remediation and CAP management. Manages vulnerability management plan. Conducts anti-phishing campaigns. Conducts and manages the security awareness and training program. Manages the third party risk management program.
• Security Architecture and Engineering: Ensures information security is designed with confidentiality, integrity, and access in mind. Sets security requirements. Ensures system redundancy and fault tolerance. Sets standards for mobile and web security. Ensures security of IoT devices.
• Security Assessment and Testing: Provides requested evidence/artifacts for all security-related assessments/audits. Coordinates and schedules security assessments required of the Enterprise. Coordinates and ensures the quality of outside vendor-provided security assessments, risk assessments, and penetration testing of enterprise assets
• Security Operations: Applies information security concepts, techniques, and best practices to support incident response plans and capabilities. Conductsand supports investigations, conducts logging and monitoring activities, securely provisions resources, tests disaster recovery plans, and addresses personnel safety and security concerns.
• Software Development Security: Provides technical consultation as required. Oversees the static and dynamic scanning of internally developed software within the company and provides reports to ensure proper remediation of code vulnerabilities. Reviews SDLC documentation to ensure compliance with established company and regulatory standards as applicable.
• This is an all-inclusive responsibility listing for all levels of Information Security Analyst. Incumbent is responsible for: Senior – Proficiency in five (5) security components:
Certifications
Certified Information Security Manager (CISM) - Information Systems Audit and Control Association (ISACA), Certified Information Systems Auditor (CISA) - Information Systems Audit and Control Association (ISACA), Certified Information System Security Professional (CISSP) - Information Systems Audit and Control Association (ISACA)
Hiring Range
$99,000.00 - $128,600.00
Security Requirements
This position is identified as level three (3). This position must ensure the security and confidentiality of records and information to prevent substantial harm, embarrassment, inconvenience, or unfairness to any individual on whom information is maintained. The integrity of information must be maintained as outlined in the company Administrative Manual.
Segregation of Duties
Segregation of duties will be used to ensure that errors or irregularities are prevented or detected on a timely basis by employees in the normal course of business. This position must adhere to the segregation of duties guidelines in the Administrative Manual.
Employment Type
Regular
ADA Requirements
2.1 General Office Worker, Semi-Active, Campus Travel - Someone who normally works in an office setting or remotely, periodically has lifting and carrying requirements up to 40 lbs and routinely travels for work within walking distance of location of primary work assignment as essential functions of the job.