Security Analyst

**DEPARTMENT DESCRIPTION**

Reporting to the Manager, Security & Risk, the Security Analyst develops, implements, and monitors system security controls to support and safeguard technology assets against internal and external security threats to the confidentiality, integrity, and availability of business information and systems. The Security Analyst will be responsible for monitoring security alerts, ensuring that alerts are investigated, and taking appropriate action.

The Security Analyst will also perform risk assessments, and take action against deviations from approved security baselines, processes, policies, and standards. This role will be instrumental in executing critical tasks, supporting audit engagements, and working with other team members to continually improve BCI’s cyber security program. The position can be based in either Vancouver or Victoria with travel between the two cities, and has three career progression levels.
- **Level 1**: Responsible for cyber security and risk analysis and support, typically acquired through 1+ years of experience. Works under guidance, applies cyber security key concepts effectively, and has demonstrated working knowledge competency within the role.
- **Level 2**: Responsible for cyber security and risk analysis and operations and contributes to projects with a low-to-mid level of complexity and stakeholder engagement, typically acquired through 5+ years of experience. Works independently and has an experienced level of competency within the role.
- **Level 3**: Responsible for cyber security risk analysis and operations and leads projects with a mid-to-high level of complexity and stakeholder engagement, typically acquired through 8+ years of experience. Works independently, provides guidance and training to others, and has an advanced level of competency within the role.

**QUALIFICATIONS**

The following qualifications are illustrative of a standard **Level 2** and may be scaled down or up in scope and depth of expertise or experience based upon the level selected.
- Degree, diploma, or certification in Computer Science, or the demonstrated level of experience and understanding listed below:

- 3+ years of cyber security experience and/or providing operational technical support within a complex technical environment
- Must have excellent customer-service, listening, communication and problem-solving skills
- Demonstrated ability to convey complex technical concepts to business users
- Strong analytical thinking and problem-solving skills
- Experience working in a US or global organization is an asset, as the team works to support our NY and London offices

**WHAT YOU WILL BE DOING**

The following responsibilities are illustrative of a standard **Level 2** and may be scaled down or up in leadership, complexity, and autonomy based upon the level selected.
- Investigates security incidents/alerts and provides input into post-incident reviews, including recommendations regarding remediation and prevention of recurrence
- Proactively identifies risks and proposes solutions to remove barriers in effective and seamless execution of day-to-day security operational tasks
- Creates dashboards, reports, and key security metrics to highlight security trends and issues within the environment and take steps to improve residual risk
- Automates repeatable tasks to improve and increase operational efficiency
- Performs validation and tuning of security tools (Crowdstrike, Proofpoint, SIEM etc.) to provide accurate and actionable results that drive improvements to BCI’s overall security posture
- Performs security monitoring of solutions and participates in security incident response scenarios
- Analyzes security controls and their effectiveness in business processes and in use of information systems; and recommends corrective actions if controls are not effective
- Assists in the development of SIEM and EDR use cases
- Assists in the vulnerability management program, including working with product owners to fulfill remediations efforts
- Represents the Security & Risk team in recurring training to IT and non-IT personnel
- Helps in maintenance of accurate documentation of security solutions
- Creates reports for periodic user access reviews and other materials required to maintain effective SOC1 and SWIFT controls
- Participates in creating security documents (policies, standards, baselines, guidelines, and procedures), provides recommendation for establishment and changes to departmental policies, procedures, and processes
- Performs other related duties as required
- Undertakes special projects or assignments as required

**WHAT YOU BRING**

For all levels, a combination of knowledge and/or hands-on experience is desired across the following areas.
- Knowledge of Information security best practices, standards, and frameworks such as NIST, CIS controls, ISO 27001, Zero-Trust etc.
- Firm grasp over security and networking concepts
- Sound working knowledge of hybrid