Cybersecurity Assurance Analyst

Candidates should be able to work East Coast Hours.

About you and the role:

The Cybersecurity Assurance Specialist provides independent, technically informed assurance over Enstar's cybersecurity tools, controls and operational processes. The role plans and performs risk-based reviews to determine whether controls are appropriately designed, configured, implemented and operating effectively.Providing expertise in network and infrastructure security and translates evidence-based observations into clear findings and practical recommendations for Cybersecurity, Technology and senior management.

The role also coordinates assurance activities with third-party staff.

What you will be doing:

Key Accountabilities / Deliverables 

Assurance Planning and Delivery
•    Plan and deliver risk-based assurance reviews of cybersecurity tools, technical controls and operational processes in accordance with the agreed assurance plan.
•    Define the objective, scope, control criteria, evidence requirements, sampling approach and test procedures for each assurance review.
•    Review architecture and data-flow diagrams, technical configurations, policies, procedures, inventories, dashboards, alerts, logs, tickets and exceptions to form evidence-based conclusions.
•    Assess both control design and operating effectiveness, clearly distinguishing between the existence of a security tool and the protection achieved through its configuration, coverage and operation.

Technology Asset and Software Governance
•    Assess the governance, completeness and accuracy of technology asset inventories across endpoints, servers, network devices, applications and cloud resources; reconcile authoritative sources, ownership, lifecycle status and security-tool coverage, and investigate unmanaged, stale, duplicate or unknown assets.
•    Review software installed across the environment against approved standards and business need; assess governance, ownership, licensing, version currency and lifecycle status, and identify unauthorized, obsolete, unsupported or end-of-life and end-of-support software for remediation.
•    Network and Infrastructure Assurance
•    Perform network and infrastructure assurance covering TCP/IP, ports and protocols, routing, subnets, CIDR, firewalls, access-control lists, proxies, NAT, VPNs, remote access, public exposure and IP allowlisting.
•    Evaluate network segmentation, trust boundaries and data flows between users, servers, applications, cloud environments, management networks and sensitive systems, and validate that implemented segmentation achieves its intended security outcome.
•    Assess DNS architecture and controls, including name resolution, domain and subdomain management, DNS records, filtering, external exposure and common DNS-related risks.
•    Review encryption controls for data at rest and in transit, including TLS, certificates, approved protocols, key management, ownership, rotation and documented exceptions.

Security Tool and Platform Assurance
•    Assess Palo Alto GlobalProtect and Prisma Access controls, including remote-access configuration, security policies, application and URL controls, routing, logging, monitoring and policy exceptions.
•    Assess CrowdStrike Falcon Complete, including sensor deployment and health, prevention policies, detections, managed response, host containment, exclusions, vulnerability exposure and escalation processes.
•    Assess Microsoft Intune, including device enrolment, the accuracy and effectiveness of device compliance checks, configuration and compliance policies, application protection, encryption, patch and security control status, exceptions, reporting and integration with Conditional Access.
•    Assess CyberArk, including privileged-account onboarding, vaulting, credential rotation, session management, monitoring, reconciliation, break-glass access and coverage reporting.
•    Assess Microsoft Azure security and networking controls, including identity, virtual networks, subnets, peering, private and public endpoints, network security groups, storage security, encryption, logging and privileged access.

AI Assurance and Security Testing
•    Conduct assurance reviews of Enstar's AI-enabled solutions and use cases.
•    Coordinate and support penetration tests, cloud and mobile assessments, social-engineering exercises, purple-team activities and EDR control validation, including scope, prerequisites, rules of engagement and review of results.
•    Assess data leaving the Enstar estate to ascertain any malicious behaviour
•    Assist in Shadow AI discovery 
•    Carry out independent validation of AI defence controls and accidental oversharing of data
•    Findings, Reporting and Remediation
•    Document findings that clearly explain the condition, supporting evidence, affected assets or processes, risk, root cause and proportionate recommended action.
•    Present assurance results to technical teams, control owners, senior management and governance forums; agree accountable owners and target dates while preserving the independence of the assurance function.
•    Track findings through completion, validate closure evidence or retesting, escalate significant or overdue actions, analyse recurring themes and support relevant KPI, KRI and Board reporting.

Perform other duties and special projects as identified from time to time.

What you will bring: 

•    Bachelor's degree in Information Systems, Computer Science, Cybersecurity or a related discipline
•    Minimum of five years of relevant experience in network security, infrastructure security, cloud security, security engineering, technical cybersecurity assurance or security consulting.
•    Experience applying structured assurance methods to evaluate control design and operating effectiveness through inquiry, inspection, observation, data analysis, sampling and reperformance.
•    Experience producing assurance reports and presenting findings to technical teams, control owners and senior management.
•    Relevant certifications such as CISSP, CISA, CRISC, CCSP, CCNA, PCNSE or AZ-500 are desirable.
•    Strong practical understanding of TCP/IP, routing, switching, subnets, CIDR, firewalls, network segmentation, DNS, VPNs, proxies, NAT, remote access, public exposure, IP allowlisting and network logging.:
•    Practical working knowledge of one or more of Palo Alto GlobalProtect and Prisma Access, CrowdStrike Falcon Complete, Microsoft Intune, CyberArk and Microsoft Azure sufficient to conduct credible and independent assurance reviews.
•    Ability to interpret network and data-flow diagrams, firewall rules, cloud and endpoint configurations, dashboards, alerts, logs, vulnerability results and penetration-test reports.
•    Knowledge of technology asset inventory and lifecycle management, endpoint protection, device compliance, software governance, vulnerability and patch management, privileged access, identity and access management, security monitoring, encryption, certificate management and incident-response processes, including the management of unauthorized, unsupported and end-of-life technology.
•    Knowledge of cybersecurity and control frameworks such as NIST CSF, ISO 27001 and CIS Controls.
•    Working knowledge of AI and generative AI security and assurance concepts, prompt injection, sensitive-data leakage, access control, model and provider risk, human oversight, output validation, monitoring and relevant guidance such as the NIST AI Risk Management Framework.

•    A strong team player who is collaborative, attentive to detail and able to challenge constructively while maintaining independence.
•    Analytical and evidence-focused, with a proactive and result-oriented approach
•    Strong written and oral communication skills, including experience producing concise assurance reports and confidently presenting findings to engineers, control owners and senior management.
•    Able to translate technical observations into clear business risk for technical and non-technical audiences.
•    Ability to work effectively with colleagues and stakeholders located across different regions and time zones.
•    Willingness to support assurance and testing activity outside normal working hours when required.
•    Willingness to travel on company business as required and agility to respond to changing security and business priorities.
Keeps abreast with changing threat landscape

Your Benefits:
•    Enstar offers best-in-class Medical, Dental, and Vision healthcare for single and family coverage.
•    Board-certified doctors and pediatricians are available virtually 24/7 for urgent care.
•    Access to Health Savings Account (HSA) or Flexible Spending Account (FSA).
•    Access to Dependent Care FSA to cover daycare expenses.
•    Access to Employee Assistance Programs (EAP) for health and well-being.
•    Optional Pet & Home/Auto Insurance.
•    Wellness Reimbursement program (up to $600 annual reimbursement for wellness-related expenses, i.e., gym memberships, massage, etc.).
•    401K retirement plan (company matches up to 6% of employee contribution).
•    One paid annual volunteer day.

General Info 
The target base salary pay range for this role is $113,000-$160,000*
*Target full-time equivalent base salary range is based on relevant market data. The actual salary offered will depend on applicable market data for the hiring location and the relevant candidate's knowledge, skills/experience. This salary range is not inclusive of applicable discretionary incentives.