Senior Information Security Analyst

Purpose:

This role is responsible for supporting the Director of IR & Threat Vulnerability in building and maintaining the enterprise-wide Vulnerability, Incident Response and Cyber Threat Management programs. The Senior Information Security Analyst performs all phases of the incident response life cycle: preparation, analysis, containment, eradication, remediation, recovery and post-incident activity for all incidents in support of the National Office and the Federation. Completes threat hunting in both on-premise and cloud environments. Responsible for identifying, triaging, filtering, and documenting vulnerabilities and threats across the enterprise and working with business unit partners to harmoniously resolve security matters. The Senior Information Security Analyst will help manage the MSSP partner for alert monitoring and will be tasked with responding, if necessary, to events/incidents on a 24x7 basis. The person will also be responsible for monitoring, building, augmenting, and integrating threat detection and remediation capabilities into security operations to address emergent cyber threats to PPFA products, services, data, and infrastructure. The Senior Information Security Analyst is expected to have a thorough understanding of complex systems and stay up-to-date with the latest security standards, products, and knowledge of the evolving threat landscape.

Delivery:

- Respond to security incidents and investigations, acting as technical lead for all phases of Incident Response.

- Analyzes existing Incident Response (IR) processes and provides actionable technical recommendations to the immediate IR team..

- Maintains and updates procedures, guidelines, and playbooks to streamline security incidents under the guidance of IR leadership

- Maintain thorough documentation of cyber threats, threat vectors, threat actors, and threat trends for threat modeling activities and security incidents.

- Assist in developing policies, procedures, and playbooks for cybersecurity, intelligence, and data protection.
- Mature and continuously benchmark the PPFA incident response playbook, liaising with vendor partners, Affiliate IT Leadership, and closely partnering with PPFA business functions.

- Monitors robust alerting and reporting mechanisms performed by MSSP as well as internal capabilities to potential cyber threats.

- Collects, analyzes, and maintains metrics and threat intelligence briefs that illustrate the impact of the current threat landscape.

- Coordinates with external forensics retainer to ensure confidential and in-depth investigations promptly, disseminating and maintaining reports on a highly confidential basis.

- Maintain current understanding of malicious adversaries, threat groups, and campaigns, indicators of compromise (IOCs), and highly granular tools.

- Develop work plans for IR and Threat Intelligence, as delegated by the Director, IR & Vulnerability Threat Management and complete initiatives within and across teams to ensure timely delivery.

Engagement:

- Support the InfoSec Operations team with vulnerability scans, penetration tests, and logging and event management results that may indicate pre-incident indicators, ineffective processes, procedures, and standards.
- Work with the team on recommendations and findings, both in written reports and in presentation format, to the Information Security Team and business unit partners

- Collaborate with key stakeholders at the National Office and the Affiliates on key findings and root cause analysis improvements.

- Support executive leader communications on potential emergent threats and ongoing efforts to resolve active cybersecurity incidents and investigations.

- Partner with stakeholders to enhance incident readiness through exercises and drills, and optimize IR and Threat Intelligence capabilities

- Collaborate with strategic vendor partners and external security research communities and cultivate durable relationships with external agencies and companies to produce a pipeline of high-quality threat intelligence.

- Work across department lines in developing product vulnerability remediation and incident response.

- Partners with architectural teams to conduct proof-of-concept evaluations for emerging technologies for security stack and production environment.

Knowledge, Skills and Abilities (KSAs):

Reporting to the Director, InfoSec Operations IR & Threat Intelligence, these are the skills and abilities that mark a strong candidate as part of our InfoSec Operations team.

- Bachelor's degree in Information Technology, Cybersecurity or equivalent experience
- Information Security certifications preferred

- 5+ years of work experience in Cybersecurity, threat detection, incident response, and vulnerability management in an Information Security Operations capacity or in a related field

- Industry certifications such as CISSP, GCIH, or CySA are highly preferred

- Experience coordinating security incident meetings, dividing responsibilities, and influencing key stakeholders to resolve security incidents.

- Experience and strong understanding of multiple forms of Indicators of Compromise (IoCs) and corresponding capabilities to detect, alert on them, and share information across key stakeholders.

- Experience with Security frameworks such as NIST CSF and MITRE ATT&CK.

- Experience with Annual Threat Assessment and Control Gap Analysis.

- Experience with building and reporting on Key Performance Indicators (KPI), Key Risk Indicators (KRI) and establishing thresholds with corrective actions.

- Knowledge of the external security community’s culture and mindset.

- Ability to recognize and respond to problems with potential solutions in a highly professional, confidential and sensitive manner.

- Familiarity with Cloud and Hybrid architectures.

- Strong interpersonal skills.

- Excellent analytical skills with sharp attention to detail and the ability to meet critical deadlines.

- Self-directed and can work alone or in a team.

- Ability to work collaboratively and flexibly with a dynamic, fast-moving team, completing multiple tasks with poise, accuracy, and confidence.

- Strong organizational, analytical, and problem-solving skills

- Strong oral and written communication skills.

- Experience in managing or leveraging a variety of security appliances, such as SIEM, EDR, Email gateways, etc.

- Flexibility and ability to adapt to quickly changing priorities and ambiguous situations

- A deep commitment to Planned Parenthood’s mission of promoting Sexual and Reproductive Health.

On-Call Rotation: Participate in a 24/7 on-call rotation to monitor, detect, and respond to urgent security alerts and potential cyber incidents.