Our Information Security Analysts know that security is a top priority for our business and our partners and customers. Today, as cyber-attacks increase and compliance is more rigorously enforced, we look to them to stay ahead of what’s next and to protect our business and our future. So if you are dedicated to the latest technology and motivating others, secure your career here. You won’t just see the problem coming, you’ll see the solution.

New threats to our business, our partners and customers appear on the horizon every day, so no two days are the same. But there are some things you can count on doing: 

• Providing guidance on information security processes, controls, and compliance, and information security risk management to team members

• Encouraging employee contribution, such as feedback, career development planning, and goal setting.

• Developing plans and strategies for information security tools, processes, and programs

• Responding to changes in the regulatory environment and assisting other organizations in doing the same.

The primary focus for the Information Security Analyst is responsible for assisting with activities designed to systematically operate Identity and Access management workflows and controls, such as assessing application data quality from the application security store, quality assurance, and awareness, and/or other project oversight, including developing standard methodologies for information security standards and handling IT controls and compliance with regulatory guidance. This position is part of the Identity and Access Management (IAM) team within Information Security.

Specific responsibilities include:

• Assists in developing, implementing and monitoring compliance to AXP and Information security policies, standards and procedures, and other policies and standards as appropriate

• Implements security policies by administering and monitoring profiles, reviewing, violation reports and investigating possible exceptions; document controls

• Prepares materials (reports, presentations, spreadsheets, etc) on information security to help develop scenarios, response procedures, and to enable informed decision-making; verify completeness, accuracy and relevance of data captured

• Utilizes tools and documented processes to ensure consistency and optimization of information security processes; work in support of efforts to measure and improve information security processes

• Prepares status reports on information security, or other matters to help develop, track, monitor and report on projects and initiatives

• Consults on controls, processes, and procedures

• Facilitates meetings to capture and document products/services or generic process

• Changes

• Maintains internal documentation library, ensuring that process and other documentation is regularly updated to reflect the latest operational processes and requirements

• Provides root cause analysis assistance for incident management or postimplementation efforts

• Provides analytical support as needed for issue management, project assessments, and reporting

• Participates in the evaluation of products and/or procedures to improve productivity and effectiveness

• Supports the analysis of underlying trends and action plans associated with information security and other domains

• Maintains records to allow for historical trending analysis.

In addition, the Information Security Analyst will:

• Analyzes complex information and identifies the most meaningful details

• Show personal determination and resilience; is optimistic in changing circumstances

• Continually seeks and learns from feedback

• Is clear when explaining ideas and concepts to others - communication is structured, compelling, and impactful, and builds a credible impression

• Knowledge in technology infrastructure security, networking, databases, systems and/or Web operations; or other information security disciplines

• Knowledge of integrated data concepts and experience with visualization tools (Visio, Power BI and SQL), data ingestion, data and metrics definitions.

• Knowledge of frameworks, standards, and best practices (i.e.NIST, PCI, ISO, COBIT, CMMI)

Qualifications:

• Experience with Identity and Access Management tools, IT Standards / IS Policies, documentation of new controls, and authoring requirements for new metrics to measure IAM processes and controls.

• Experience with information security risk management and process improvement.

• Must have knowledge or awareness in security, compliance and/or other risk domain(s).

• Requires knowledge of a minimum of several business and technical functional capabilities in the following areas: security architecture; security engineering; threat management; vulnerability management; electronic discovery; computer and data breach incident management; data protection; forensics; 3rd party/vendor management; security monitoring; cryptography; security operations and administration; access management; security policies and standards; security awareness; business continuity; disaster recovery; IT risk management and controls; web security; data security; network security; system security, technology operations and compliance.

• 2 years of Information Security / Identity and Access Management Experience

• Bachelor’s Degree in Computer Science, Information Systems, Business Administration, or other related field (or equivalent work experience) is preferred. Holds, or will soon attain CISM, CRISC, CISSP or other Security Certifications.