Sr. Information Security Analyst (#1679)

We are seeking a Senior Information Security Analyst to serve as a subject matter expert for business areas and technical teams, and act as the customer interface for Information Security Operations. In this 12-month contract role based in Philadelphia, Pennsylvania, you will strengthen security posture by evaluating, testing, documenting, and operationalizing security solutions and controls across on-premises and cloud environments-while enabling the business to innovate securely. You will collaborate closely with audit and exam teams, technology management, and business stakeholders while contributing to incident preparedness and response.

Responsibilities

• Serve as subject matter expert on security fundamentals, techniques, and technologies across Azure, AWS, GCP, and on-premises environments.
• Guide cloud security architecture including identity and access management, encryption and key management, network controls, data protection, and workload hardening.
• Implement process improvements aligned to security frameworks such as NIST CSF, NIST 800-53, and ISO 27001; optimize technology to improve customer experience.
• Implement and monitor controls for unusual and suspicious activity across endpoints, networks, and cloud platforms.
• Perform advanced monitoring, data and log analysis, threat hunting, and forensic investigations; contribute to SOC and incident response workflows.
• Plan, contribute to, and participate in incident plan exercises and tabletop scenarios.
• Draft or revise local policies, standards, guidelines, and procedures to supplement enterprise frameworks; identify and remediate gaps based on NIST standards.
• Interface with internal and external auditors and examiners; maintain vendor management standards, questionnaires, and regulatory documentation for frameworks including HITRUST, PCI, NIST, HIPAA, and SOC2.
• Review contracts and provide security guidance; support project scoping, costing, and cost-benefit analyses.
• Act as a liaison for the security team; clearly communicate business risk as it relates to information security.
• Create technical documentation including reports, white papers, technical notes, and implementation and configuration guides.
• Use visual aids to convey complex topics to large, diverse audiences; communicate clearly in high-pressure, high-visibility situations.
• Recommend new security solutions and improvements that do not impede innovation.
• Stay current with the evolving threat landscape; consistently learn and grow to remain ahead of emerging threats.

Qualifications

• Required

• 5-8 years of relevant information security experience, or 3-5 years in IT systems administration with strong security responsibilities.

• Expertise in incident response, system monitoring and analysis, and risk assessments aligned with compliance and privacy laws.

• Knowledge of compliance requirements including HITRUST, PCI, NIST, HIPAA, and SOC2.

• Knowledge across multiple platforms: Windows, Linux/Unix, macOS; networks and endpoints.

• Experience with vulnerability assessment and penetration testing engagements.

• Experience with change management and project management.

• Excellent technical writing and presentation skills; ability to translate technical risk to business impact.

• Preferred

• CCSP certification; other relevant certifications including AZ 500, AWS Security Specialty, or GCP Professional Cloud Security Engineer.

• Experience securing Azure, AWS, and GCP in enterprise and hybrid environments.

• Familiarity with NIST CSF, ISO 27001, CIS Benchmarks, and MITRE ATT&CK.

• Experience with Azure security tools including Defender for Cloud, Microsoft Sentinel, Entra ID, Conditional Access, Key Vault, NSGs, Azure Firewall, and storage encryption.

• Experience with AWS security tools including IAM roles and policies, Security Hub, GuardDuty, KMS, CloudTrail, CloudWatch, VPC security controls, AWS WAF, and Secrets Manager.

• Experience with GCP security tools including IAM, Security Command Center, Cloud Audit Logs, VPC Service Controls,