Senior Information Security Analyst
A senior individual contributor who owns SIS's information security program day to day: running the ISMS, leading the company's ISO 27001 certification effort in the first ~8 months, managing tooling like SentinelOne EDR and SIEM in a ~90% macOS environment, and fielding client security questionnaires. Reports to the Director of Technology within an ITIL-based framework.
- Compensation
- Not disclosed
- Location
- Culver City, CA 90230
- Work setup
- Not specified
- Seniority
- Senior
- Employment
- Contract
- Experience
- Not specified
- Category
- Security
- Posted
Skills
Must have
- Lead ISO 27001 certification end to end, incl. Statement of Applicability, gap assessment, control implementation, and Stage 1/Stage 2 audits (first ~8 months)
- Own day-to-day ISMS operation: risk assessment, control implementation, policy development, internal audit readiness, evidence collection
- Administer and monitor security tooling: SentinelOne EDR, SIEM, vulnerability management, email security, data protection
- Own vulnerability management and remediation across endpoints, infrastructure, and cloud, incl. patching, encryption, hardening, least-privilege reviews
- Build and automate security operations via scripting and platform integration (continuous control monitoring, automated evidence collection)
- Support security incident response: investigation, containment, root cause analysis, post-incident reporting
- Conduct security reviews of enterprise applications (Salesforce, Sage Intacct, workforce management, internal apps)
- Establish secure development and application security requirements, incl. secure coding standards and dependency/vulnerability scanning
- Serve as primary respondent for client security questionnaires (CAIQ, SIG, custom formats)
- Contribute security standards for physical security technologies (video management, access control, AI-based analytics)
- Work within an ITIL-based operational framework
- Onboard enterprise applications to centralized identity (SSO, automated provisioning) and run access reviews
- Perform third-party risk assessments and vendor/contract security reviews
Full description
About the role:
The Senior Information Security Analyst is a senior individual contributor responsible for advancing SIS's information security program and for leading the company's effort to achieve and maintain ISO 27001 certification. This individual owns the day-to-day operation of the Information Security Management System (ISMS)—risk assessment, control implementation, policy development, internal audit readiness, and evidence collection—and serves as the primary respondent to client cyber security surveys, questionnaires, and third-party assessments. The role is measured by steady, incremental progress against SIS's published security objectives across the cloud, identity, endpoint, and network environment, as well as the physical security technologies deployed at SIS offices and at client sites monitored by the Fusion Center. SIS operates a predominantly Apple environment (approximately 90% macOS) supporting a 24/7 Global Security Operations Center. The Senior Information Security Analyst works within an ITIL-based operational framework and reports directly to the Director of Technology.
This is an individual contributor role without direct reports. The Senior Information Security Analyst operates as a peer to the Senior Manager of IT Infrastructure and Senior Manager of Applications and works closely with the IT Infrastructure, Applications, Help Desk, and Fusion Center teams to implement and validate security controls across the enterprise. The position carries functional authority for security requirements and compliance obligations, influencing technical direction through subject matter expertise rather than direct supervision.
In this role, your responsibilities will be:
-
Design and maintain security reference architectures and technical security standards across the cloud, identity, endpoint, network, application, and physical security domains, and review proposed designs and infrastructure changes against them (15%)
-
Administer, tune, and monitor security tooling in partnership with the Senior Cloud Administrator, including endpoint detection and response (SentinelOne), vulnerability management, email security, data protection, and a Security Information and Event Management (SIEM) solution, ensuring alerts are actionable and triaged (10%)
-
Own vulnerability management and remediation across endpoints, infrastructure, and cloud services, including patch currency, device encryption, configuration hardening, and periodic least-privilege access reviews (10%)
-
Build and automate security operations through scripting and platform integration, including continuous control monitoring, automated evidence collection, access review workflows, and alert enrichment, reducing reliance on manual, point-in-time compliance effort (10%)