Cybersecurity Analyst

Surmodics is pursuing highly differentiated medical devices that are designed to address unmet clinical needs and engineered to the most demanding requirements. This key growth strategy leverages the combination of the Company's expertise in proprietary surface technologies, along with enhanced device design, development and manufacturing capabilities. The Company mission remains to improve the detection and treatment of disease.

The Cybersecurity Analyst is responsible for the company security posture consisting of the identification, protection, detection, response and recovery for all company information systems. The analyst must provide cybersecurity expertise in most areas of infrastructure and software solutions - both online and on-premise. The Analyst will leverage external resources for additional expertise, monitoring and training as well as manage the vendor relationship with these resources. The Analyst works company-wide to ensure that systems and networks are always designed, developed, deployed, and managed using current security practices.
Responsibilities
Identification

• Asset Management - identify the locations of all company data and devices storing and/or processing company data.
• Business Environment - identify what types of data the company is storing and/or processing (classification of data for privacy, confidentiality, regulatory and all compliance requirements).
• Governance - define company policies, procedures and processes to manage security risk.
• Risk Assessment - continually evaluate and update the company's current state through testing and assessment of existing security landscape aligned with the company's target risk profile.
• Risk Management Strategy - determine the company's target risk profile based on tolerance, impact and cost to the businesses. Develop plan to reach the company's desired state.

Protection

• Identity Management and Access Control - identify all system access controls and ensure proper processes and systems are in place to provide appropriate access to individuals based on approved job role.
• Awareness and Training - ensure effective training programs are in place to educate the employee population on current relevant security risks.
• Data Security - define and create awareness within the employee population for data classification.
• Information Protection Processes and Procedures - provide solutions for protecting the various classifications of data accordingly.
• Maintenance - ensure all security protection systems and tools are kept up to date and current for protecting against emerging threats.
• Protective Technology - implement and manage all security systems and tools used on company assets. Manage all suppliers of technology used for company security.

Detection

• Anomalies and Events - configure and manage our detection systems to ensure they provide useful information in a timely manner.
• Security Continuous Monitoring - ensure monitoring is in place and providing useful information at the right time to mitigate potential issues. Manage any 3rd parties used to provide security monitoring.
• Detection Processes - configure, test and monitor the company detection systems to ensure they are working properly and compliant with company security governance.

Response

• Response Planning - define and develop the response plan and processes based on the various probable scenarios.
• Communications - develop the communication processes used for informing internal and external stakeholders of threat and mitigation activities.
• Analysis - manage and interpret 3rd party analysis and conduct internal analysis of threats.
• Mitigation - manage 3rd party mitigation activities and conduct internal mitigation of threats.
• Improvements - develop and manage a continuous improvement process for threat and mitigation response to ensure unrepeatable events.

Recovery

• Recovery Planning - define and develop the recovery plan and processes used based on the various probable scenarios.
• Improvements - create and manage a recovery debrief process to ensure future efficient recovery.
• Communications - develop the communication processes used for informing internal and external stakeholders of recovery activities.

Minimum Qualifications

• Associate's degree in computer science or 3 years of hands-on computer support experience
• 1-5 years' experience in the field, such as security administration
• Must have ability to exercise independent judgment in planning, organizing, and performing systems analyst tasks
• Knowledge of cybersecurity best practices as well as capabilities and limitations of technology
• Documentation and Technical writing skills
• Experience in the Medical or Medical Device industry preferred
• Good customer service and personal skills
• Advanced troubleshooting and problem-solving skills
• The ability to work in a high stress environment
• Self-motivating and self-starter that can think outside the box
• The ability to remain current on the latest technology and best practices in information security

Surmodics offers a competitive compensation and benefits package, including a bonus program, 401(k) with employer match, employee stock purchase plan and stock options.

Surmodics is an Equal Opportunity Employer. All qualified applicants will receive consideration for employment without regard to race, color, religion, sex, sexual orientation, gender identity, national origin, disability or veteran status.

---