Information Security Analyst

About the role

The Information Security Analyst will design, integrate and enhance the company’s security governance frameworks, ensuring that controls are consistent, optimized and meet regulatory standards such as PCI and IT‑SOX.

Key responsibilities

• Develop and implement security frameworks and controls (ISO 27001:2013, SAN Top 20, OWASP Top 10).
• Manage a risk‑based vendor risk program, assessing and treating risks from internal customers, consultants and service providers.
• Lead PCI and IT‑SOX compliance initiatives and maintain related documentation.
• Define baseline hardening standards for all IT systems and ensure continuous monitoring via SIEM and XDR solutions.
• Expand and oversee the patch‑management process using a risk‑based approach.
• Update policies and procedures to reflect business needs and industry best practices.
• Create and deliver cyber‑security awareness content.
• Conduct periodic vulnerability scans and coordinate penetration testing.
• Provide after‑hours support as required.

Required profile

• Bachelor’s degree in Computer Science or a related field.
• At least 3 years of hands‑on experience in information security.
• Professional certifications such as CISSP, CISA or CISM are preferred.
• Strong analytical, problem‑solving and communication skills.
• Ability to work independently and manage multiple tasks in a fast‑paced environment.

Required skills

• ISO 27001, SAN Top 20, OWASP Top 10 frameworks.
• PCI DSS and IT‑SOX compliance.
• SIEM, XDR, DLP, FIM, application whitelisting and ERM tools.
• Data classification, access control and security models.
• Authentication protocols and encryption algorithms.
• TCP/IP protocol suite, vulnerability scanning and penetration testing.
• Patch‑management processes.