Job Summary:The Sr. Global Cybersecurity Analyst is responsible for leading application security and vulnerability management across the organization. The role serves as the primary point of contact for security assessment of applications, SaaS platforms, and third-party software, and is responsible for identifying, prioritizing, and driving remediation of vulnerabilities across the environment.
This position administers and supports vulnerability management and application security tooling, performs secure code and secure configuration review, and supports secure software development practices for internally developed and vendor-supplied applications. The role also contributes to the security review of artificial intelligence (AI) tools and features adopted by the business. The role provides security support, contributes to security awareness initiatives, maintains security controls and documentation, and supports the ongoing operation and improvement of the organization's cybersecurity program.
This role is onsite four days per week and remote one day per week. Candidates must live within a reasonable commuting distance of our Westfield, IN location. This is not a fully remote position. Preference will be given to candidates who currently reside within the local commuting area.Duties/Responsibilities: - Lead the application security review and intake process for new and updated applications, SaaS platforms, and third-party software, including data classification, architecture and integration review, access model review, and vendor security posture evaluation.
- Own the vulnerability management lifecycle across endpoints, servers, cloud workloads, and applications, including discovery, validation, risk-based prioritization, remediation tracking, and reporting.
- Perform application security assessment activities, including secure code review, software composition and dependency analysis, secure configuration review, and web application vulnerability scanning.
- Partner with development, infrastructure, and business application teams to define remediation timelines, drive findings to closure, and manage documented exceptions and risk acceptances.
- Administer and maintain vulnerability management and application security tooling, including Microsoft Defender and Rapid7 InsightVM.
- Maintain the application inventory and produce metrics and reporting on vulnerability exposure, remediation performance, and application risk for technology and business leadership.
- Support secure software development lifecycle (SDLC) practices, including security requirements definition, threat modeling, and security sign-off prior to production deployment.
- Conduct security reviews of AI and machine learning tools and features, including data handling, subprocessor and data residency considerations, and alignment with the organization's AI use standards.
- Manage security support requests and provide technical assistance to employees regarding security-related issues.
- Maintain security procedures, standards, system documentation, and operational runbooks.
- Participate in security awareness and training initiatives.
- Support cybersecurity projects, compliance activities, audits, and other security program initiatives.
- Perform other duties as assigned.
Required Skills/Abilities: - Effective planning and priority setting. Ability to manage several complex projects simultaneously while working under pressure to meet deadlines.
- Strong analytical, problem-solving, and troubleshooting skills.
- Ability to manage multiple priorities and projects while meeting deadlines in a fast-paced environment.
- Ability to work independently and collaboratively with cross-functional teams.
- Strong verbal and written communication skills.
- Application security assessment, including secure code review, threat modeling, and secure architecture and configuration review.
- Vulnerability management lifecycle, including scanning, risk-based prioritization using CVSS, EPSS, and known exploited vulnerability data, remediation tracking, and exception management.
- Application security standards and frameworks, including the OWASP Top 10, OWASP ASVS, CIS Benchmarks, and NIST secure development guidance.
- Vulnerability management and application security tooling, such as Microsoft Defender, Rapid7 InsightVM, or comparable platforms.
- Software development and deployment practices, including source control, CI/CD pipelines, APIs, containers, and cloud-hosted and SaaS applications.
- AI and machine learning security concepts, including model and data handling risk, prompt injection, and third-party AI service and subprocessor risk.
- Third-party and SaaS security assessment, including data classification, data privacy considerations, and vendor security posture evaluation.
- Ability to translate technical vulnerability and application security findings into clear business-language recommendations for technical and non-technical audiences.
Education and Experience:- Bachelor's degree in Computer Science, Information Technology, Cybersecurity or related field
- Five (5) or more years of progressive cybersecurity experience, with demonstrated experience in application security, vulnerability management, and third-party software or SaaS security assessment.
- CompTIA Security+ certification or equivalent cybersecurity certification required.
- Application security, cloud security, or offensive security certifications preferred (for example, CSSLP, GWAPT, OSCP, or Microsoft security certifications).
- Must have valid driver's license and meet MVR guidelines.
Physical Requirements: - Prolonged periods of sitting at a desk and working on a computer.
- Frequent use of standard office equipment, including a computer, keyboard, and telephone.
- Must be able to communicate effectively in person and virtually.
- Must be able to occasionally lift and carry up to 15 pounds.
- Ability to travel occasionally, if required.
