Senior Information Security Analyst

Wells Fargo is seeking a highly motivated Senior Information Security Analyst to support the Findings & Exposure Management Oversight team. This role will provide independent oversight across the findings and exposure lifecycle, including intake and prioritization, remediation monitoring, closure assurance, exposure reporting, and Patch Oversight.

The analyst will partner with accountable owners, operational teams, data owners, risk authorities, and leadership to improve risk visibility, strengthen accountability, challenge remediation outcomes, and support timely escalation and sustained risk reduction. The ideal candidate will bring strong information security risk management, findings management, data analysis, control assessment, and stakeholder consultation capabilities.

In this role, you will:

·       Apply lifecycle standards and risk thresholds to findings, security exposures, patch risks, and exceptions from intake through closure or risk acceptance.

·       Review intake records for completeness, risk-based prioritization, and assignment of accountable owners.

·       Independently challenge remediation plans, milestones, exception rationale, and supporting evidence.

·       Monitor remediation progress, identify barriers and missed commitments, and coordinate central escalation of overdue or material items.

·       Validate closure evidence and support independent challenge of residual-risk acceptance rationale before closure or risk acceptance decisions.

·       Analyze findings and exposure data to identify trends, aging, data-quality issues, and emerging risks.

·       Support certified metrics, executive dashboards, and recurring reporting that connect materiality, trend, ownership, required action, and source records.

·       Perform recurring data-quality reviews and reconciliations to assess record completeness, accuracy, ownership, and status.

·       Support Patch Oversight by reviewing patch-not-deployed rationale, overdue approvals, PTS data quality, and escalation requirements.

·       Contribute to targeted reviews, control effectiveness assessments, issue analysis, and continuous improvement of the oversight model.

·       Prepare clear, decision-oriented communications for leadership and governance forums.

·       Mentor and support less experienced team members and promote consistent application of oversight practices.

·       4+ years of Information Security Analysis experience, or equivalent demonstrated through one or a combination of the following: work experience, training, military experience, education

·       3+ years of experience performing information security assessments, findings reviews, security reviews, or control evaluations.

·       3+ years of experience analyzing security risks, reviewing remediation plans, and escalating missed commitments.

·       4+ years of Information Security, Cybersecurity, Compliance, Findings Management, Vulnerability Management, or Information Security Analysis experience; or equivalent demonstrated through a combination of work experience, training, military experience, or education.

·       3+ years of experience interpreting and applying information security policies, standards, control requirements, or regulatory expectations.

·       Experience with enterprise findings, issue, vulnerability, exposure, or patch management processes.

·       Experience independently challenging remediation plans, exceptions, closure evidence, or residual-risk decisions.

·       Experience with compliance reviews, data-quality reviews, or control effectiveness assessments.

·       Experience developing security metrics, executive dashboards, trend reporting, or risk exposure analyses.

·       Knowledge of information security frameworks and standards such as NIST, ISO 27001, CIS Controls, COBIT, or similar frameworks.

·       Knowledge of vulnerability management, patch management, exception management, and remediation practices.

·       Experience supporting regulatory, internal audit, or external audit examinations.

·       Strong analytical and problem-solving skills, including the ability to reconcile data, identify trends, assess evidence, and translate information into actionable insights.

·       Strong written and verbal communication skills with the ability to present complex risk information to technical and non-technical audiences.

·       Ability to build effective relationships, influence outcomes, and provide credible challenge while maintaining independent oversight.

·       Bachelor's degree in Information Security, Cybersecurity, Computer Science, Information Technology, Business, or a related field.

·       Professional certification such as CISSP, CISM, CRISC, CISA, Security+, or a related certification.

·       Knowledge of cloud security concepts and controls within AWS, Azure, or Google Cloud environments.

·       This position is not available for Visa sponsorship.

·       This position requires working in a hybrid environment from one of the posted locations.

·       There is no relocation allowance for this position.

Posting End Date:

*Job posting may come down early due to volume of applicants.