Senior Information Security Analyst

Security Industry Specialists, Inc.; Culver City (CA); On-site; USD 122,000 - 149,000; Full time

Benefits offered by this job

Health, Dental, Vision

401k

Paid Time Off

Job summary

Security Industry Specialists, Inc. in Culver City, CA is seeking a Senior Information Security Analyst to drive the ISMS and lead the company toward ISO 27001 certification.

You will own risk assessment, policy development, and evidence collection while coordinating with the Fusion Center and Director of Technology. The role emphasizes hands-on security engineering across cloud, identity, endpoint, and network security, with support for physical security tech and a 24/7 SOC.

Qualifications

• Bachelor’s degree or equivalent in IT/cybersecurity.
• 7+ years in information security with hands-on engineering or admin roles.
• Experience designing security architecture and automation.
• Familiarity with cloud services and macOS environments.

Responsibilities

• Design and maintain security architectures across cloud, identity, endpoint, network, and physical security.
• Administer security tooling and SIEM, monitor alerts, and triage incidents.
• Own vulnerability management and remediation across endpoints and cloud services.
• Automate security operations and evidence collection.
• Lead ISO 27001 certification activities and audit readiness.
• Respond to client security surveys and third-party assessments.

Skills

ISO 27001

Cloud security

SIEM

Vulnerability management

Identity & access management

Security architecture

Scripting (Python/Bash)

Third‑party risk

App security

Physical security tech

Leadership/mentoring

Education

Bachelor's degree in Computer Science/Information Technology/Cybersecurity

Tools

SentinelOne

SIEM

Okta/Entra ID

Salesforce

Sage Intacct

AWS/Azure

Job description

Job Details: Job Location: Culver City, CA 90230, Position Type: Full Time, Salary Range: $135,000.00 - $135,000.00 Salary/year, General Statement of Job:

The Senior Information Security Analyst is a senior individual contributor responsible for advancing SIS's information security program and for leading the company's effort to achieve and maintain ISO 27001 certification. This individual owns the day-to-day operation of the Information Security Management System (ISMS)—risk assessment, control implementation, policy development, internal audit readiness, and evidence collection—and serves as the primary respondent to client cyber security surveys, questionnaires, and third-party assessments. The role is measured by steady, incremental progress against SIS's published security objectives across the cloud, identity, endpoint, and network environment, as well as the physical security technologies deployed at SIS offices and at client sites monitored by the Fusion Center. SIS operates a predominantly Apple environment (approximately 90% macOS) supporting a 24/7 Global Security Operations Center. The Senior Information Security Analyst works within an ITIL-based operational framework and reports directly to the Director of Technology.

Essential Job Functions:

• Design and maintain security reference architectures and technical security standards across the cloud, identity, endpoint, network, application, and physical security domains, and review proposed designs and infrastructure changes against them (15%)
• Administer, tune, and monitor security tooling in partnership with the Senior Cloud Administrator, including endpoint detection and response (SentinelOne), vulnerability management, email security, data protection, and a Security Information and Event Management (SIEM) solution, ensuring alerts are actionable and triaged (10%)
• Own vulnerability management and remediation across endpoints, infrastructure, and cloud services, including patch currency, device encryption, configuration hardening, and periodic least-privilege access reviews (10%)
• Build and automate security operations through scripting and platform integration, including continuous control monitoring, automated evidence collection, access review workflows, and alert enrichment, reducing reliance on manual, point-in-time compliance effort (10%)
• Support security incident response, including investigation, containment coordination, documentation, root cause analysis, and post-incident reporting, working closely with IT Infrastructure and Fusion Center leadership (5%)
• Conduct security reviews of enterprise business applications, including Salesforce, Sage Intacct, the enterprise workforce management platform, and internally developed applications, covering role and permission models, segregation of duties, data sharing and export controls, API and integration credentials, audit logging, and data retention (5%)
• Establish secure development and application security requirements for custom and client-facing applications, including secure coding standards, dependency and vulnerability scanning, penetration testing cadence, and remediation tracking with internal development and vendor teams (5%)
• Drive onboarding of enterprise applications to centralized identity, including Single Sign-On and automated provisioning, and conduct periodic application-level access reviews and offboarding validation (2%)
• Contribute information security and technical expertise to the standards and longer-term strategy for physical security technologies in use at SIS offices and at client sites monitored by the Fusion Center, including video management and camera platforms, access control and badge systems, and emerging AI-based detection and video analytics capabilities, in partnership with the Director of Technology, Fusion Center leadership, and other system owners (5%)
• Ensure physical security systems are deployed and maintained in line with information security requirements, including network segmentation, device hardening, credential and certificate management, firmware currency, centralized logging, and data retention and privacy obligations (5%)
• Perform security review of new technologies, vendors, and contracts, including third-party risk assessment and review of security exhibits and data protection terms (3%)
• Lead SIS's ISO 27001 certification effort end to end, including scoping and the Statement of Applicability, gap assessment against Annex A controls, hands-on implementation and configuration of the technical controls, internal audit, remediation of findings, and successful completion of the Stage 1 and Stage 2 certification audits (TEMPORARY, FIRST ~8 MONTHS)
• Operate and mature the Information Security Management System on an ongoing basis, maintaining the risk register and risk treatment plans, coordinating management review, tracking corrective actions, and preparing the organization for annual surveillance audits and recertification (5%)
• Serve as the primary respondent for client cyber security surveys, security questionnaires, and third-party risk assessments (for example, CAIQ, SIG, and custom client formats), maintaining a curated answer library and evidence repository, and converting identified gaps and client commitments into tracked remediation items driven to closure with the responsible technical owners (5%)
• Define, measure, and report on SIS's security objectives and key security metrics, delivering visible incremental improvement quarter over quarter and reporting progress to technology leadership and key stakeholders (5%)
• Develop and maintain information security policies, standards, procedures, and control documentation, and deliver the company's security awareness and role-based training program (3%)
• Maintain accurate documentation and audit evidence supporting compliance objectives such as ISO 27001, SOC 2, and client contractual security requirements (2%)
• Provide senior-level security guidance and escalation support to the IT, Help Desk, and business teams, and mentor junior administrators and coordinators (5%)
• Perform other related duties as required

Qualifications: Minimum Qualifications and Requirements:

• Bachelor's degree in Computer Science, Information Technology, Cybersecurity, or a similar field, and relevant experience; equivalent combination of education and experience will be considered
• 7+ years of progressive information security experience, at least 4 of which in a hands-on security engineering or systems administration capacity in a cloud-first environment
• Demonstrated ability to design security architecture and implement and configure controls directly, including scripting and platform integration for automation (such as Python, Bash, or API-driven workflows); this is a hands-on engineering and operations role rather than an audit or advisory role
• Strong working knowledge of security tooling, including endpoint detection and response (SentinelOne or similar), vulnerability management platforms, email security, and SIEM
• Working knowledge of identity and access management concepts, including Single Sign-On, multi-factor authentication, least-privilege role-based access, and periodic access reviews across Active Directory/Entra ID and a modern IdP (Okta, Ping, JumpCloud, or similar)
• Experience securing cloud and SaaS platforms (such as Google Workspace, Box, AWS, and Azure) in a predominantly Apple/macOS environment (approximately 90% Mac) with some Windows
• Experience assessing and hardening enterprise business applications such as Salesforce, ERP platforms (Sage Intacct or similar), workforce management or scheduling platforms, and custom-developed applications, including role-based permission models, segregation of duties, integration and API security, and audit logging
• Working knowledge of application security and secure development practices, including the OWASP Top 10, dependency and vulnerability scanning, penetration testing, and secure SDLC, is a strong plus
• Working knowledge of physical security technologies, including video management systems and IP camera platforms and access control and badge systems (such as Genetec, Milestone, Avigilon, Verkada, Lenel, or similar), and the network, hardening, and data protection considerations associated with them
• Familiarity with AI-based detection and video analytics capabilities and their operational, accuracy, and privacy implications is a strong plus
• Demonstrated experience implementing, achieving, or maintaining ISO 27001 certification, or a comparable framework such as SOC 2, NIST CSF, or NIST 800-53, including risk assessment, control implementation, evidence collection, and audit support
• Direct experience completing client and third-party cyber security surveys and security questionnaires (such as CAIQ, SIG, HECVAT, or custom client formats) and maintaining the supporting evidence repository
• Understanding of privacy and data protection requirements (such as CCPA/CPRA, GDPR, and BIPA) as they apply to surveillance, biometric, and access control data
• Familiarity with ITIL operational processes (incident, problem, change, and configuration management) and the ability to work effectively within a structured operations environment
• Industry certifications preferred (e.g., ISO 27001 Lead Implementer, CISSP, AWS Certified Security - Specialty, Ping Identity Certified Professional - PingOne, Jamf Certified Tech, or CompTIA Security+)
• Excellent documentation, analytical, troubleshooting, and communication skills, with the ability to explain security requirements to both technical and non-technical audiences and deliver a high level of customer service
• Must be a dependable team player with business maturity, enthusiasm, and the ability to work both independently and collaboratively

What we can offer:

• $135,000 annual salary
• Health, Dental, Vision, and 401k for eligible employees
• Paid Time Off, including Sick/Safe Time
• A dynamic and challenging work environment with opportunity for growth

Additional Information:

• Private Detective #28063
• Private Patrol Operator #13936