Security Analyst

<p>Bond, Schoeneck &amp; King is hiring a <b>full-time Security Analyst</b> to support the Information Technology Department and strengthen the firm’s information security program. This hybrid role is based in <b>Buffalo, Albany, or Syracuse, NY</b>, with responsibilities spanning security monitoring, incident response, vulnerability and identity management, and governance and compliance support.</p><h3>Key Responsibilities</h3><ul><li>Monitor, investigate, and respond to security events using sound judgment, clear documentation, and timely escalation.</li><li>Support maturation of security operations, including vulnerability management, identity governance, security awareness, and reporting capabilities.</li><li>Convert technical security findings into practical risk language for IT leadership and non-technical stakeholders.</li><li>Monitor alerts and telemetry from <b>SIEM</b>, <b>XDR/EDR</b>, email security, identity systems, cloud, network, and vulnerability management platforms.</li><li>Triage suspicious activity by validating severity, correlating indicators, and documenting findings in incident or case records.</li><li>Recommend tuning, automation, and process improvements to reduce alert noise and improve detection quality.</li><li>Assist with identification, containment, eradication, recovery, and post-incident documentation for cybersecurity incidents.</li><li>Escalate material events with evidence, impact assessment, business context, and recommended next steps.</li><li>Contribute to playbooks, tabletop exercises, lessons learned, and continuous improvement of incident response procedures.</li><li>Support recurring vulnerability scanning, risk prioritization, remediation tracking, and exception documentation.</li><li>Work with infrastructure and application teams to address vulnerabilities based on exploitability, business criticality, and client confidentiality risk.</li><li>Provide status updates and metrics covering remediation progress, aging risk, recurring issues, and barriers to closure.</li><li>Support access reviews, privileged access monitoring, conditional access, MFA compliance, and joiner/mover/leaver control validation.</li><li>Help protect sensitive firm and client information through monitoring, policy enforcement, encryption, data loss prevention, and secure collaboration practices.</li><li>Identify access or configuration gaps that may impact confidentiality, ethical wall obligations, or client expectations.</li><li>Maintain security documentation, standard operating procedures, control evidence, expectation records, and management reporting materials.</li><li>Use recognized security frameworks and standards to align security practices with the firm’s risk tolerance and professional services expectations.</li><li>Support security awareness campaigns, phishing simulations, targeted guidance, and practical education for attorneys and staff.</li><li>Support identifying recurring user behavior risks and recommend training, technical controls, or process refinements.</li></ul><h3>Required Qualifications</h3><ul><li><b>Bachelor’s Degree</b> in cyber security, computer science, engineering, or related field (required).</li><li><b>2+ years</b> of experience in a cybersecurity or IT role.</li><li>Security certifications such as <b>Security+, CySA+, SSCP, CISSP Associate, AZ-500, SC-200, SC-300</b>, or similar credentials.</li><li>Proficiency using cybersecurity tools including <b>SIEM</b>, <b>IDS/IPS</b>, <b>EDR</b>, and <b>vulnerability scanners</b>.</li><li>Strong analytical and problem-solving skills, including the ability to analyze complex data and identify patterns and anomalies.</li><li>Excellent verbal and written communication skills, with the ability to communicate technical information to non-technical stakeholders.</li><li>High attention to detail and accuracy, including the ability to work under pressure and manage multiple tasks.</li><li>Ability to work effectively as part of a team and collaborate across departments.</li><li>Knowledge of information security frameworks including <b>ISO 27000, NIST,</b> or <b>COBIT</b>.</li><li>Knowledge of security standards such as <b>HIPAA, NIST, PCI, SOX, DFARS, FISMA, NYDFS</b>, and others.</li><li>Participation in a <b>24x7 on call rotation</b>.</li><li>Some travel may be required to Regional Offices.</li></ul><h3>Technology Stack</h3><ul><li>SIEM (Security Information and Event Management)</li><li>XDR/EDR</li><li>Email security</li><li>Identity systems</li><li>Cloud and network platforms</li><li>Vulnerability management platforms</li><li>IDS/IPS (Intrusion Detection System/Intrusion Prevention System)</li><li>Vulnerability scanners</li><li>ISO 27000, NIST, COBIT</li><li>HIPAA, PCI, SOX, DFARS, FISMA, NYDFS</li></ul><h3>Hybrid Location</h3><ul><li>Buffalo, NY</li><li>Albany, NY</li><li>Syracuse, NY</li></ul><h3>Compensation</h3><p><b>$95,000 - $105,000 per year</b>, negotiable based on years’ experience.</p><h3>Offer Contingencies</h3><ul><li>Completion of a satisfactory conflicts check</li><li>Completion of a satisfactory background check</li><li>Completion of a satisfactory reference check</li></ul><br />#J-18808-Ljbffr