Information Security Analyst
Global Village Worker Ltd ·
- Category
- Security
- Experience
- 8+ years
Position advertised: Information Security Analyst
Job specification
The security analyst plays a vital role in keeping an organization’s proprietary and sensitive information secure. He/she works inter-departmentally to identify and correct flaws in the company’s security systems, solutions, and programs while recommending specific measures that can improve the company’s overall security posture.
Duties and responsibilities
Security analysts are ultimately responsible for ensuring that the company's digital assets are protected from unauthorized access. This includes securing both online and on-premise infrastructures, weeding through metrics and data to filter out suspicious activity, and finding and mitigating risks before breaches occur. If a breach does occur, security analysts are often on the front line, leading efforts to counter the attack.
Security analysts are also responsible for generating reports for IT administrators and business managers to evaluate the efficacy of the security policies in place. They will then help to make the necessary changes for a more secure network and may also create training programs and modules to educate employees and users on proper security protocols.
Furthermore, security analysts are responsible for keeping the company's security systems up to date and creating documentation and planning for all security-related information, including incident response and disaster recovery plans.
Other specific responsibilities include:
Monitoring security access
Conducting security assessments through vulnerability testing and risk analysis
Performing both internal and external security audits
Analyzing security breaches to identify the root cause
Continuously updating the company’s incident response and disaster recovery plans
Verifying the security of third-party vendors and collaborating with them to meet security requirements
Here are some important areas of expertise that today’s security analysts should possess and why:
Ethical hacking aims to expose weak points and identify potential threats so that the organization can protect itself from malicious hackers. This includes penetration testing during which an analyst will test networks, computers, web-based applications, and other systems to detect exploitable vulnerabilities.
- Intrusion prevention involves monitoring network traffic to detect potential threats and then responding to these threats promptly.
Incident response manages the negative effects of an attack or breach, from minimizing the impact to altering security controls for future prevention.
Computer forensics aids in the prevention of crime through the collection, analysis, and reporting of data. It also enables an analyst to create evidence in the event of a breach.
Reverse engineering allows an analyst to comprehend why a piece of software does what it does so that he/she can patch a bug or analyze malware.
- In addition, security analysts are expected to have expertise in cyber security, firewalls, network security, information assurance, Linux, UNIX, security information and event management (SIEM), application security, security engineering, and security architecture. They must also keep up with the latest trends in cyber security.
- The most successful analysts are detail-oriented and have an analytical mindset. For the most part, security analysts work with scenarios – and this could mean poring over thousands and thousands of pages of data to look for anomalies. Interpersonal skills are also crucial; analysts need to train company staff on better security protocols and regularly communicate with executive leadership.
Qualifications and skills required
There are several certifications beneficial for existing analysts pursuing ongoing education as well as for other security professionals looking to become security analysts: The Certified Ethical Hacker credential recognizes your abilities to lawfully use the same knowledge and tools as a malicious hacker to improve an organization's security posture.
CompTIA Network+ is a vendor-neutral certification that validates your skills and knowledge on designing, managing, troubleshooting, and configuring networks.
CWAPT Certified Penetration Tester certifies that you possess the skills to perform web application penetration testing.
Certified Reverse Engineering Analyst validates your skills and knowledge in malware analysis.
Experience needed
Matric, with Tertiary Education - preferably an IT Diploma or Bachelor’s Degree
5 - 8 years or more Information security experience at a Senior engineer level with good exposure to medium to large corporate or government environments
Very good knowledge of Cyber security solutions
All relevant technical and industry certifications such as:
Fortinet Network Security Professional Certification – NSE 6 or higher including the following modules: Fortinet NSE 6 - FortiADC
Fortinet NSE 6 - FortiDDoS
FortiWeb 5.6 Specialist
Fortinet NSE 6 - FortiWeb 6.0
CISSP certification (will be advantageous)
Preference will be given to someone with CheckPoint Certified Security Expert (CCSE) (CCSM)
Strong FortiGate FW configuration and architectural solution design
Ability to perform Vulnerability and Risk assessments
In-depth knowledge and proven expert proficiency in designing, engineering, configuring, and maintaining of large enterprise firewalls such as Fortinet
Minimum requirements
8 years experience in a similar role.