Lead Cybersecurity Analyst

Objective & Core Principles

The fundamental objective of this role is to support Community Choice Credit Union in fulfilling its mission: to assist our community in achieving their desired life. A crucial aspect of this mission is to deliver exceptional service to both internal and external stakeholders by embodying our core principles.

Role Summary:

This role entails the management of essential security systems and the evaluation of risk and compliance across all credit union applications, systems, and networks. Collaborating closely with other IT professionals, the primary focus will be on administering functions that bolster the compliance and effectiveness of the Comprehensive Information Security Plan. This position functions as an individual contributor within the organization and collaborates with the Technology teams.

Key Competencies

• Core Principles:
  1. Dedicated: We are devoted to serving Michigan, guided by the foundational principles of service, integrity, and respect for every individual.
  2. Generous: We contribute significantly every day to our members, communities, and each other. We are committed to supporting Michigan through our time and services.
  3. Trustworthy: We are our Members' reliable financial advisors; each team member plays a vital role in the financial well-being of our Members and the success of Community Choice Credit Union.
  4. Collaborative: We are a cohesive team. We unite to achieve success, celebrate achievements, and continuously enhance the service we provide to our members and communities.
• Flexibility/Proactivity: Adapts swiftly and effectively to evolving conditions and demands, viewing change as an essential and inevitable part of organizational life and an opportunity for learning. Capable of taking on various tasks and roles within the organization, seamlessly transitioning between different focuses and filling in for absent team members. Seeks innovative and productive ways to add value to the organization and/or team. Exhibits a positive attitude in the face of organizational change and provides constructive feedback for ongoing improvement.

Position Competencies

1. Responsibility: Sets clear expectations for self and others to meet goals and objectives, defines roles and responsibilities, provides regular feedback, and communicates deadlines and desired outcomes clearly. Holds self accountable for actions and continuously seeks feedback for personal growth.
2. Critical Thinking: Decomposes problems and issues into manageable components, assessing the costs, benefits, and risks of various options before selecting a particular approach. This includes the ability to articulate alternatives and justify decisions logically and systematically.
3. Mastery of Essential Duties: Capable of executing essential responsibilities as outlined in the job description. Contributes productivity and value within the role. Demonstrates a willingness to learn and enhance performance.

Key Responsibilities

• Manage critical security systems, including but not limited to data loss prevention, network access controls, and intrusion detection/prevention.
• Maintain knowledge of rules and regulations to ensure compliance with all IT policies and applicable regulations.
• Provide insights for network configurations, upgrades, performance, and disaster recovery to swiftly address any data integrity issues, security vulnerabilities, or system interruptions.
• Conduct intrusion detection and response across all network nodes to ensure data integrity and safeguard the credit union's intellectual assets through mitigation strategies and remediation activities.
• Collaborate with the IT team to ensure timely and effective deployment of system updates and security patches across all relevant systems.
• Oversee and verify software and vendor licenses for legal use and compliance to prevent interruptions in team member access to software/hardware.
• Assist in administering the Comprehensive Information Security Program to ensure data integrity and protect the credit union's intellectual assets.
• Develop departmental procedures and documentation to track all changes made to network nodes while supporting controls and security initiatives.
• Plan, coordinate, and implement security measures for information systems to regulate access to computer data files and prevent unauthorized modifications, intrusions, destruction, or disclosures of information.
• Educate users and promote security awareness to enhance system security and improve server and network efficiency.
• Monitor current reports of computer viruses and intrusion detection to determine when to update virus protection or intrusion protection systems.
• Document computer security and emergency measures policies, procedures, and tests.
• Engage with users to discuss issues such as computer data access needs, security violations, and programming changes.
• Stay informed and educated on relevant and emerging threats such as malware or phishing campaigns, attack vectors, indicators of compromise, vulnerabilities, and current events.
• Maintain a high quality of service for the Member Center Information technology systems through proactive system management.
• Assess, report, and communicate on threats, vulnerabilities, and risks, recommending appropriate remedial actions for affected technologies, business units, or departments.
• Collaborate, brainstorm, and develop solutions to enhance the Cybersecurity program.
• Document issues properly and provide timely updates to the IT team on open issues/vulnerabilities and opportunities for efficiency improvements.
• Coordinate the Information Security component of external audits.
• Oversee the maintenance of security risk assessments.
• Ensure adherence to the National Institute of Standards and Technology framework and internal Security Program that safeguards the integrity and confidentiality of the organization.
• Ensure the smooth operation of the vulnerability scanning solution and engage with system owners regarding system patching.
• Continuously stay updated on IT security trends and news, communicating with team members and management.
• Research, evaluate, document, and discuss findings with IT teams and management.
• Review various findings to provide recommendations for delivering security fixes and improvements.
• Ensure enforcement of acceptable use policies and security guidelines.

Qualifications

To successfully perform this role, an individual must be able to execute each essential duty satisfactorily. The requirements listed below represent the knowledge, skills, and/or abilities necessary for this position.

Remote Work Eligibility

This position is fully eligible for a Hybrid Work Arrangement.

Reasonable Accommodations

The physical and mental demands are representative of those that must be met by an employee to successfully perform the essential functions of their job. Reasonable accommodations may be made to enable individuals with disabilities to perform the essential job requirements.

Education

Bachelor's Degree in Computer Science: Required.

Experience

4 years of technical security experience.

4 years of experience in security detection techniques, event analysis, and logic development.

5 years of experience in IT operations.

Preferred Certifications

Certifications in Information Security, Digital Forensics Incident Response (DFIR), and penetration testing training are desired but not mandatory. Examples include CISSP, GIAC, Microsoft Certified Systems Administrator: Security.

Skills & Abilities

General knowledge of virus protection, penetration testing, and communications security.

Proficiency in virus protection, penetration testing, security awareness, and other information security concepts.

Ability to communicate effectively with all levels of employees and external contacts.

Familiarity with the Cyber Kill Chain Framework and working knowledge of the MITRE ATT&CK Framework.

Knowledge of malware analysis, Threat Hunting, Detection Engineering, and reverse engineering.

Mental Demands

The team member must be able to read and interpret documents, understand and follow complex instructions, make decisions, recall multiple policies or procedures, resolve problems in a timely manner, express oneself clearly, perform mathematical functions, and manage multiple concurrent tasks.

Physical Demands

The physical demands described here are representative of those that must be met by an employee to successfully perform the essential functions of this job. Reasonable accommodations may be made to enable individuals with disabilities to perform the essential functions.

While performing the duties of this job, the employee is regularly required to talk or hear. The employee frequently needs to sit and use hands to manipulate or feel. The employee occasionally needs to stand, walk, reach with hands and arms, and stoop, kneel, crouch, or crawl. The employee must occasionally lift and/or move up to 25 pounds.

Work Environment

The work environment characteristics described here are representative of those an employee encounters while performing the essential functions of this job. Reasonable accommodations may be made to enable individuals with disabilities to perform the essential functions. The noise level in the work environment is usually moderate.

General Statement

The above statements are intended to describe the general nature and level of work being performed by individuals assigned to this role. They are not intended to be an exhaustive list of all responsibilities, duties, skills, or working conditions.