Security Analyst Associate, GRC

The Security Analyst Associate reflects the mission, vision, and values of Northwestern Medicine (NM) and works within Northwestern Medicine Information Services to support innovative, high-value solutions in health care. The role involves alert investigation, incident response, security gap analysis, risk identification and reporting, vulnerability assessment, and daily operational security tasks to protect NM's assets. Northwestern Medicine is an equal opportunity employer. A background check, including criminal history, is conducted on newly hired team members.

Responsibilities

Help in alerts investigation generated by security controls and implement provided recommendations to improve detection capability accuracy; Participate in the optimization of incident response standards and procedures to increase the organization's cyber resiliency; Analyze the enterprise information security environment and identify potential gaps in security measures; Help identify, evaluate, and report on information security risks; Collaborate with vendors and internal departments to optimize performance of security controls; Collaborate with network and technology support teams to enhance security processes and documentation; Participate in the evaluation and assessment of information security vulnerabilities, solutions, and organizational posture; Stay current with security technologies and threats to contextualize events observed in the environment; Assist in providing initial assessment of impact severity for IT security incidents and executing the appropriate response; Investigate fraud and other computer issues; Perform daily operational tasks to protect NM's assets, including analyzing security alerts, maintaining endpoint protection infrastructure, and facilitating risk evaluation related to vulnerability assessment findings and coordinating risk treatment

Requirements

0-2 years of experience; Working knowledge of network (protocols, topologies, TCP/IP); Working knowledge of security controls (proxies, IPS, IDS, firewall, and packet analyzers); Working knowledge of systems (Windows, Linux/UNIX); Working knowledge of software development (development / scripting languages); Working knowledge of incident response; Working knowledge of threat and vulnerability management; Working knowledge of security standards/controls under IT governance and compliance models (NIST, HIPAA, PCI, ISO 27001 & 27002, ITIL); Excellent problem-solving skills; Demonstrated timely task completion with solid organizational skills, task tracking, follow-up, and productive peer interaction; Excellent verbal and written communication skills

Nice to have

Bachelor's degree preferred or equivalent combination of education and experience; Certification or courses: Security+, GSEC, GCWN, GCED or CEH

Benefits

Tuition reimbursement; Loan forgiveness; 401(k) matching; Lifecycle benefits; Wide range of benefits covering physical, emotional, and financial well-being and protection for unexpected life events; Sign-on bonus may be included in some postings, subject to eligibility rules