Sr. Analyst, Infrastructure and InfoSec

Toyota Deutschland GmbH; San Juan (PR); On-site; USD 90,000 - 130,000; Full time

Job summary

Toyota Deutschland GmbH seeks an Information Security professional to govern security policies, manage access to assets, and drive security awareness across the organization. The role collaborates with IT to ensure regulatory compliance and corrects vulnerabilities in a structured, risk-based approach.

The position covers governance, vulnerability management, incident response, and security operations, reporting to the Information Security Officer and regional GISG teams to align with corporate

Qualifications

• Experience in information security governance and regulatory requirements.
• Ability to produce monthly risk indicators and reports for IT security.
• Experience with access control, attestation, and onboarding/offboarding processes.

Responsibilities

• Understand business processes, policies, and governance practices.
• Ensure compliance with GISG/TMCC security standards.
• Produce monthly Key Risk Indicators and security metrics.
• Provide security status to ISO and GISG regional representative.
• Identify non-compliance and submit exceptions for approval.
• Monitor vulnerability and endpoint management activities and remediation progress.
• Oversee security operations and infrastructure upgrades.
• Assist ISO with incident response, testing, and postmortem reviews.

Skills

InfoSec

Security Governance

Access Administration

Security Awareness

Vulnerability Management

Endpoint Management

Security Operations

Incident Response

Infrastructure Support

Job description

Overview

Who we are

Collaborative. Respectful. A place to dream and do. These are just a few words that describe what life is like at Toyota. As one of the world’s most admired brands, Toyota is growing and leading the future of mobility through innovative, high-quality solutions designed to enhance lives and delight those we serve. We’re looking for talented team members who want to Dream. Do. Grow. with us.

Primary Job Accountabilities

Information / Cyber Security (InfoSec)

Security Governance

• Attain a strong understanding of business processes, policies, procedures, governance practices and regulatory requirements.
• Ensure all processes and technologies are compliant with TFS Information Security standards (GISG, TMCC, etc.).
• Complete monthly report of Key Risk Indicators for IT Security Department including vulnerabilities scores, endpoint compliance, material incidents, etc.
• Provide InfoSec status to ERMC committee when needed.
• Identify non-compliance to security standards or controls and submit exceptions for approval.
• Provide status and metrics of information security activities and review with Information Security Officer (ISO) and AOR GISG regional representative for TCPR.
• Attend AOR InfoSec-GISG/GISS meetings to learn best practices and updated activities for InfoSec. Communicate updates pertaining to TCPR.

Access Administration

• Ensure access to information assets is authorized by management and asset owners.
• Ensure that user access is monitored and regularly reviewed (attestation).
• Ensure new hires are provided with equipment and access in a timely manner.
• Ensure the access for terminated users are removed in a timely matter.

Security Awareness

• Manage and conduct all required security training. Ensure that all team members and new hires complete the required security awareness training.
• Report to IT Manager the list of team members who are not in compliance with training or fail phishing tests.
• Comply with all continued education requirements, including professional courses, certifications, seminars, trainings, etc., to support the business need.

Information Asset Management

• Ensure security requirements are addressed throughout the lifecycle of all TCPR assets.
• Ensure inventories of information assets; including on-premises/cloud network, servers/ workstations, operating systems, applications, and mobile computers and devices are securely configured and issued.
• Ensure with TMCC that all network devices, servers, workstations, mobile devices, and all other endpoints are protected and monitored for malicious activities.

Vulnerability and Endpoint Management

• Identify and track system and application vulnerabilities.
• Perform research and analysis of complex vulnerability incidents until resolved to ensure compliance metrics are being met. This includes cross collaboration to obtain root cause, recommend and determine best fix and apply patch.
• Work with IT and other resources on vulnerability remediation plans including dates for remediation and responsibilities. Monitor status and progress of remediation and report to IT Manager.
• Provide TCPR’s ISO with periodic status updates on remedial efforts.
• Monitor endpoint protection compliance to ensure metric is met weekly for monthly reporting. If issues are found must review, research, and analyze to resolve.

Security Operations and Infrastructure

• Oversee technological upgrades, tasks, improvements, and major changes to the information security environment.
• Support the security infrastructure and technologies established for TCPR.
• Conduct logging of network and system activities (users, local applications, access to physical assets, etc.).
• Monitor logs and other sources of information (users, applications, networks, systems, access to physical assets, etc.).
• Analyze, assess, and address suspected malicious activities and elevate appropriately.

Incident Response and Management

• Member of the Security Incident Response Team (SIRT) as a technical SME.
• Assist the ISO with security incidents (detection, analysis, response, and recovery).
• With the ISO, perform tests, exercises, and drills of all response plans.
• With the ISO, perform problem management, root cause analysis, and postmortem reviews following the occurrence of incidents.
• With the ISO, conduct forensic investigations by working with law enforcement and other regulatory bodies during and following an incident.

Infrastructure and Network Support

• Provide direct technical support to onsite infrastructure managed by TMCC.
• Implement