Risk and Security Analyst- Onsite

Gulf Coast Educators Federal Credit Union; Pasadena (TX); On-site; USD 90,000 - 130,000; Full time

Job summary

Gulf Coast Educators Federal Credit Union in Pasadena, TX is seeking a Risk and Security Analyst to lead the credit union's information security risk management program within the IT department. The role develops, implements, monitors, and continually improves security controls and incident response capabilities to protect confidential information and operational systems.

The analyst collaborates with IT staff, vendors, and leadership to assess risk, enforce policies, manage third-party risk,

Responsibilities

• Security operations and engineering: Oversee the implementation, configuration, monitoring, maintenance, and effectiveness of information security technologies, including firewalls, endpoint security, email security, encryption, network detection and prevention, security monitoring, and other preventive and detective controls. Coordinate with internal IT teams and service providers to address identified security events and control deficiencies.
• Vulnerability And Exposure Management: Manage the vulnerability and exposure management program, including vulnerability scanning, penetration testing, configuration assessments, tracking of remediation activities, validation of corrective actions, risk acceptance documentation, and reporting of unresolved exposures.
• Incident Response And Security Monitoring: Lead or coordinate the investigation, containment, eradication, recovery, documentation, and post-incident review of cybersecurity incidents. Maintain incident response procedures, escalation paths, communication protocols, evidence-handling practices, and relationships with internal and external response resources. Participate in periodic incident response exercises. Notify relevant stakeholders within timely manner.
• Governance, Risk And Compliance: Maintain and continually improve the Credit Unions information security governance and risk management program. Conduct or coordinate cybersecurity risk assessments, monitor security control effectiveness, support regulatory examinations and audits, maintain evidence of compliance, track corrective actions, and provide security risk reporting to management.
• Third Party Cybersecurity Risk: Assess cybersecurity risks associated with applicable third-party relationships. Review security documentation, risk assessments, contractual security requirements, incident notification provisions, remediation plans, and ongoing monitoring results in coordination with Vendor Management, Compliance, Legal, and business owners.
• Identity And Access Risk Oversight: Provide security oversight of identity and access management controls, including privileged access, multifactor authentication, access reviews, segregation of duties, authentication standards, and timely removal or modification of access.
• Strategic Planning And Emerging Threats: Develop, maintain, communicate, and support enforcement of information security policies, standards, procedures, and employee security awareness initiatives. Provide targeted education based on emerging threats, incidents, testing results, and organizational risk.
• Regulatory Compliance: Responsible for compliance with Bank Secrecy Act and all governmental regulations and Credit Union policies and guidelines. Responsible for complying with Federal Rules and Regulations as required by NCUA.

Job description

GCEFCU is seeking a Risk and Security Analyst to join our IT department! The Risk and Security Analyst is responsible for leading and administering the Credit Unions cyber and information security risk management program. This position develops, implements, monitors, and continually improves security controls, policies, standards, technologies, and response capabilities designed to protect the confidentiality, integrity, and availability of Credit Union information and systems. This position is located onsite at our Pasadena location.

Essential Functions And Responsibilities

Security operations and engineering: Oversee the implementation, configuration, monitoring, maintenance, and effectiveness of information security technologies, including firewalls, endpoint security, email security, encryption, network detection and prevention, security monitoring, and other preventive and detective controls. Coordinate with internal IT teams and service providers to address identified security events and control deficiencies.

Vulnerability And Exposure Management

Manage the vulnerability and exposure management program, including vulnerability scanning, penetration testing, configuration assessments, tracking of remediation activities, validation of corrective actions, risk acceptance documentation, and reporting of unresolved exposures.

Incident Response And Security Monitoring

Lead or coordinate the investigation, containment, eradication, recovery, documentation, and post-incident review of cybersecurity incidents. Maintain incident response procedures, escalation paths, communication protocols, evidence-handling practices, and relationships with internal and external response resources. Participate in periodic incident response exercises. Notify relevant stakeholders within timely manner.

Governance, Risk And Compliance

Maintain and continually improve the Credit Unions information security governance and risk management program. Conduct or coordinate cybersecurity risk assessments, monitor security control effectiveness, support regulatory examinations and audits, maintain evidence of compliance, track corrective actions, and provide security risk reporting to management.

Third Party Cybersecurity Risk

Assess cybersecurity risks associated with applicable third-party relationships. Review security documentation, risk assessments, contractual security requirements, incident notification provisions, remediation plans, and ongoing monitoring results in coordination with Vendor Management, Compliance, Legal, and business owners.

Identity And Access Risk Oversight

Provide security oversight of identity and access management controls, including privileged access, multifactor authentication, access reviews, segregation of duties, authentication standards, and timely removal or modification of access.

Strategic Planning And Emerging Threats

Develop, maintain, communicate, and support enforcement of information security policies, standards, procedures, and employee security awareness initiatives. Provide targeted education based on emerging threats, incidents, testing results, and organizational risk.

Regulatory Compliance

Responsible for compliance with Bank Secrecy Act and all governmental regulations and Credit Union policies and guidelines. Responsible for complying with Federal Rules and Regulations as required by NCUA.

Performs other job-related duties as assigned.

EOE Disabled/Veteran