Information Security Analyst - III

The Judge Group - Boston, MA

Full-time - Mid Level

Remote - Boston, MA

Administrative and Support Services

About the position

The Information Security Analyst - III position is a remote role focused on enhancing product security within the organization. The selected candidate will serve as a Product Security Penetration Tester/Engineer, tasked with ensuring the adoption of a robust product security framework across the product business unit. This role is critical in improving the security of various products and solutions, including devices, software, and cloud infrastructure. The individual will collaborate with a cross-functional team to enhance the design and development processes, ensuring that security considerations are integrated from the ground up. Key responsibilities include conducting formal penetration testing of existing and future products, performing product security risk assessments, and developing remediation plans. The analyst will also be involved in awareness and training initiatives, incident response activities, and strategic security initiatives. The role requires a proactive approach to identifying security vulnerabilities and proposing innovative security features that can enhance product offerings. The analyst will be responsible for tracking adherence to product security requirements throughout the software development lifecycle, both pre- and post-commercialization. In addition to technical skills, the position demands strong communication abilities to effectively document and discuss security findings with management and product management teams. The analyst will provide clear reporting on vulnerabilities, including potential resolutions and recommendations, and will assist with security incident response as needed. This role is essential for fostering a culture of security within the organization and ensuring that security best practices are followed across all product lines.

Responsibilities

• Perform formal penetration testing of products and solutions, including remediation planning and solution identification.
• Conduct Threat Modeling & Vulnerability Management processes and tools for all developed products/services/solutions.
• Research, document, and discuss security findings with management and product management teams.
• Perform design and implementation security reviews for all products and ensure adoption of product security framework and policies.
• Provide feedback and verification of remediation for identified vulnerabilities.
• Provide clear and concise reporting of vulnerabilities and defects with potential resolutions and recommendations.
• Track and report adherence to product security requirements throughout the software development lifecycle, pre- and post-commercialization.
• Propose and evaluate innovative new security features that could benefit our products.
• Develop technical solutions to address security weaknesses and collaborate with relevant stakeholders to effectively implement them in our products.
• Assist with security incident response as needed.

Requirements

• Expertise in conducting application security assessments covering threat modeling, design reviews, project management, and in-depth implementation audits.
• A minimum of 2 to 5 years of industry experience in security and development.
• Solid foundation in formal penetration testing, ethical hacking of embedded systems, web applications, and complex networked systems.
• Demonstrate knowledge of product security requirements and secure coding standards, e.g., NIST SP 800-53, ISO/IEC 27001, OWASP, SEI CERT, and MS Secure Coding Standards.

Nice-to-haves

• Engaging business and technology stakeholders at all levels to gather long-term goals and requirements.
• Demonstrating hands-on engineering experience with enterprise security technology.
• Contributing to a central technology service organization.
• Navigating a matrix organization.
• Collaborating with multiple stakeholders across functional and technical skill sets.