Sr Information Security Analyst (Cloud/Enterprise Security) - Hybrid (PA/NJ/DE)

Independence Blue Cross; Philadelphia (Philadelphia County); Hybride; USD 110 000 - 150 000; Plein temps

Avantages offerts par ce poste

Hybrid work model

Equal Opportunity Employer

Résumé du poste

Independence Blue Cross in the Philadelphia region is seeking a Sr Information Security Analyst (Cloud/Enterprise Security) to drive security controls across Azure, AWS, GCP, and on‑prem environments, while enabling the business to innovate securely.

As a SME and security operations lead, you will contribute to incident preparedness, threat monitoring, and governance programs aligned to HITRUST, PCI, NIST, and ISO standards in a collaborative, hybrid environment.

Qualifications

• 5–8 years of relevant information security experience (or 3–5 years in IT systems administration with strong security responsibilities).
• Expertise in incident response, system monitoring/analysis, and risk assessments aligned with compliance and privacy laws.
• Knowledge with compliance requirements: HITRUST, PCI, NIST, HIPAA, SOC2.

Responsabilités

• Serve as SME on security fundamentals, techniques, and technologies across Azure, AWS, GCP, and on‑prem environments.
• Implement and monitor controls for unusual and suspicious activity across endpoints, networks, and cloud platforms.
• Draft or revise local policies, standards, guidelines, and procedures to supplement enterprise frameworks; identify and remediate gaps based upon NIST standards.

Connaissances

Incident response

Security monitoring

Risk assessments

Compliance standards

Windows

Linux

Vulnerability assessment

Penetration testing

Project management

Technical writing

Outils

Qualys

NexusIQ

MS Sentinel

MDE

Elastic

Description du poste

Sr Information Security Analyst (Cloud/Enterprise Security) - Hybrid (PA/NJ/DE)

We are seeking a passionate, adaptable Information Security Analyst who will serve as a subject matter expert (SME) for business areas and technical teams, and act as the customer interface for the Information Security Operations function. You will strengthen our security posture by evaluating, testing, documenting, and operationalizing security solutions and controls across on‑premises and cloud environments (Azure, AWS, GCP)—while enabling the business to innovate securely.

Continuous learning is a requirement to stay ahead of adversaries. This includes tracking modern attack techniques, and applying rigor to protect confidentiality, integrity, and availability of valued information assets. Expect close collaboration with audit/exam teams, technology management, and business stakeholders, plus meaningful contributions to incident preparedness and response.

Key Responsibilities:

Cloud & Enterprise Security (SME)

• Serve as SME on security fundamentals, techniques, and technologies across Azure, AWS, GCP, and on‑prem environments.
• Guide cloud security architecture: IAM, encryption/key management, network controls, data protection, workload hardening.
• Implement process improvements aligned to security frameworks (NIST CSF/800‑53, ISO 27001) and business needs; optimize technology to improve customer experience.

Security Operations & Incident Response

• Implement and monitor controls for unusual and suspicious activity across endpoints, networks, and cloud platforms.
• Perform advanced monitoring, data/log analysis, threat hunting, and forensic investigations; contribute to SOC/IR workflows.
• Plan, contribute to, and participate in incident plan exercises and tabletop scenarios.

Governance, Risk & Compliance (GRC)

• Draft or revise local policies, standards, guidelines, and procedures to supplement enterprise frameworks; identify and remediate gaps based upon NIST standards.
• Interface with internal/external auditors and examiners; maintain vendor management standards, questionnaires, and regulatory documentation (HITRUST, PCI, NIST, HIPAA, SOC2).
• Review contracts and provide security guidance; support project scoping, costing, and cost–benefit analyses.

Stakeholder Engagement & Communication

• Act as a liaison for the security team; clearly communicate business risk as it relates to information security.
• Create technical documentation (reports, white papers, technical notes, implementation/configuration guides).
• Use visual aids to convey complex topics to large, diverse audiences; communicate clearly in high‑pressure, high‑visibility situations.
• Recommend new security solutions and improvements that do not impede innovation.
• Stay current with the evolving threat landscape; consistently learn and grow to remain a step ahead of attackers.

Technical Expertise

Cloud Security (Azure, AWS, GCP)

• Azure: Defender for Cloud, Microsoft Sentinel, Entra ID (Azure AD), Conditional Access, Key Vault, NSGs/Azure Firewall, storage encryption, Defender for Endpoint integration.
• AWS: IAM roles/policies, Security Hub, GuardDuty, KMS, CloudTrail/CloudWatch, VPC security controls, AWS WAF, Secrets Manager.
• GCP: IAM, Security Command Center, Cloud Audit Logs, VPC Service Controls, CMEK/KMS, Cloud Armor, Workload Identity; container security (GKE).

Additional Technologies

• Operating Systems: Linux, Windows Server, Windows Desktop; hardening, patching, CIS Benchmarks.
• SIEM & Logging: MS Sentinel, MDE, Elastic; Endpoint management/log forwarding. Microsoft Data Lake, CRIBL
• Vulnerability & AppSec: Qualys, NexusIQ; OWASP‑aligned testing and remediation.
• Secure Productivity: Securing Microsoft 365 (Exchange Online, SharePoint/OneDrive, Teams, Purview).

Qualifications:

Required

• 5–8 years of relevant information security experience (or 3–5 years in IT systems administration with strong security responsibilities).
• Expertise in incident response, system monitoring/analysis, and risk assessments aligned with compliance and privacy laws.
• Knowledge with compliance requirements: HITRUST, PCI, NIST, HIPAA, SOC2.
• Knowledge across multiple platforms: Windows, Linux/Unix, macOS; networks and endpoints.
• Experience with vulnerability assessment and penetration testing engagements.
• Experience with change management and project management.
• Excellent technical writing and presentation skills; ability to translate technical risk to business impact.

Preferred

• CCSP preferred; other certs: AZ‑500, AWS Security Specialty, GCP Professional Cloud Security Engineer.
• Experience securing Azure, AWS, GCP in enterprise/hybrid environments.
• Familiarity with NIST CSF, ISO 27001, CIS Benchmarks, MITRE ATT&CK.

Hybrid

Independence has implemented a “Hybrid” model which consists of Associates working in the office 3 days a week (Tuesday, Wednesday & Thursday) and remotely 2 days a week (Monday & Friday). This role is designated as a role that fits into the “Hybrid” model. While associates may work remotely on our designated remote days, the work must be performed in the Tri-State Area of Delaware, New Jersey or Pennsylvania.

IBX is an Equal Opportunity Employer. All qualified applicants will receive consideration for employment without regard to their age, race, color, religion, sex, national origin, sexual orientation, protected veteran status, or disability.

Inclusion and Belonging

At IBX, everyone can feel valued, supported, and comfortable to be themselves, and all associates have a fair opportunity to achieve their full potential. We put these principles into action every day by acting with integrity and respect. Celebrating and embracing diverse thoughts and perspectives that make up our workforce means our company is more vibrant, innovative, and better able to support the people and communities we serve.

About Our Company

Serving more than 8 million people nationwide, including 2.5 million in southeastern Pennsylvania, Independence Health Group — together with its subsidiaries — is the leading health insurance organization in the Philadelphia region. Our mission to build healthier lives for you, your family, and your employees shapes our actions and decisions every day.

At Independence, we see each of our members as an individual, with unique needs and concerns. We’re dedicated to harnessing the very latest ideas and technologies to deliver access to care that meets those needs and surpasses your expectations. For more information about Independence access our website at www.ibx.com . We’re revolutionizing health care, and our focus is on you!

IBX is an Equal Opportunity Employer. All qualified applicants will receive consideration for employment without regard to their age, race, color, religion, sex, national origin, sexual orientation, protected veteran status, or disability.

Agency Disclaimer

All resumes submitted directly to anIndependence Blue Cross employee from a vendor via email, the Internet or in any other form without a valid written search agreement in place for this position from the Independence Blue Cross Family of Companies Human Resources Department will be deemed the sole property of Independence Blue Cross andthe Independence Blue Cross Family of Companies. Please note that no fee will be paid in the event the candidate is hired by Independence Blue Cross orthe Independence Blue Cross Family of Companies as a result of the referral or through means other than our established process.

Current Associates

Create and manage profiles for future opportunities, and review prior submissions.

IBX is dedicated to safeguarding what matters most to you. Please protect yourself by staying vigilant against phishing scams involving fake IBX job postings and individuals posing as IBX representatives offering fraudulent job opportunities. What you should know:

• IBX will never request payment of any kind in connection with the hiring or onboarding process.
• IBX will never ask for sensitive personal information, such as your Social Security Number, over the phone or via email.
• Our recruitment process requires job applicants to apply directly through the official application on this site.