Senior Information Security Analyst

SECURITY INDUSTRY SPECIALISTS INC offers a $135,000 annual salary and a benefits package designed for eligible employees, including Health, Dental, Vision, and 401k, plus Paid Time Off with Sick/Safe Time. This role supports a dynamic, challenging environment with room for professional growth while helping strengthen the organization’s information security program.

This Senior Information Security Analyst position is an onsite role in Culver City, CA. The role is a senior individual contributor responsible for advancing the company’s information security program and leading the effort to achieve and maintain ISO 27001 certification.

Responsibilities

• Design and maintain security reference architectures and technical security standards across cloud, identity, endpoint, network, application, and physical security; review proposed designs and infrastructure changes (15%)
• Administer, tune, and monitor security tooling with the Senior Cloud Administrator, including SentinelOne, vulnerability management, email security, data protection, and a SIEM; ensure alerts are actionable and triaged (10%)
• Own vulnerability management and remediation across endpoints, infrastructure, and cloud services, including patch currency, device encryption, configuration hardening, and periodic least-privilege access reviews (10%)
• Build and automate security operations using scripting and platform integration to support continuous control monitoring, automated evidence collection, access review workflows, and alert enrichment (10%)
• Support incident response through investigation, containment coordination, documentation, root cause analysis, and post-incident reporting in coordination with IT Infrastructure and Fusion Center leadership (5%)
• Conduct security reviews for enterprise business applications such as Salesforce, Sage Intacct, the enterprise workforce management platform, and internally developed applications (5%)
• Establish secure development and application security requirements for custom and client-facing applications, including secure coding standards, dependency and vulnerability scanning, penetration testing cadence, and remediation tracking (5%)
• Drive onboarding of enterprise applications to centralized identity, including Single Sign-On and automated provisioning, plus periodic application access reviews and offboarding validation (2%)
• Contribute information security guidance for physical security technologies used at SIS offices and client sites monitored by the Fusion Center, including video management and camera platforms, access control and badge systems, and AI-based detection and analytics capabilities (5%)
• Ensure physical security systems align with information security requirements, covering network segmentation, device hardening, credential and certificate management, firmware currency, centralized logging, and data retention and privacy obligations (5%)
• Perform security review of new technologies, vendors, and contracts, including third-party risk assessment and review of security exhibits and data protection terms (3%)
• Lead the ISO 27001 certification effort end to end, including scoping and Statement of Applicability, gap assessment against Annex A controls, hands-on technical control implementation, internal audit support, remediation, and completion of Stage 1 and Stage 2 audits (TEMPORARY, FIRST ~8 MONTHS)
• Operate and mature the ISMS on an ongoing basis by maintaining the risk register and risk treatment plans, coordinating management review, tracking corrective actions, and preparing for annual surveillance audits and recertification (5%)
• Act as the primary respondent for client cyber security surveys, security questionnaires, and third-party risk assessments (e.g., CAIQ, SIG, and custom formats), maintaining an answer library and evidence repository, then converting identified gaps and commitments into tracked remediation items (5%)
• Define, measure, and report security objectives and key security metrics, delivering incremental improvement quarter over quarter (5%)
• Develop and maintain information security policies, standards, procedures, and control documentation, and deliver security awareness and role-based training (3%)
• Maintain accurate documentation and audit evidence supporting compliance objectives such as ISO 27001, SOC 2, and client contractual security requirements (2%)
• Provide senior-level security guidance and escalation support to IT, Help Desk, and business teams, and mentor junior administrators and coordinators (5%)
• Perform other related duties as required

Requirements

• Bachelor’s degree in Computer Science, Information Technology, Cybersecurity, or a similar field, plus relevant experience (equivalent education and experience considered)
• 7+ years of progressive information security experience, with at least 4 years in hands-on security engineering or systems administration in a cloud-first environment
• Hands-on capability designing security architecture and directly implementing controls, including automation through scripting and platform integration (e.g., Python, Bash, or API-driven workflows); this is engineering and operations focused rather than an audit or advisory role
• Working knowledge of security tooling including SentinelOne (or similar), vulnerability management platforms, email security, and SIEM
• Identity and access management knowledge, including Single Sign-On, multi-factor authentication, least-privilege role-based access, and periodic access reviews across Active Directory/Entra ID and modern IdPs (e.g., Okta, Ping, JumpCloud, or similar)
• Experience securing cloud and SaaS platforms such as Google Workspace, Box, AWS, and Azure in a predominantly Apple/macOS environment (~90% Mac) with some Windows
• Experience assessing and hardening enterprise business applications (e.g., Salesforce, Sage Intacct or similar ERP, workforce management or scheduling platforms, and custom applications), including role-based permissions, segregation of duties, integration and API security, and audit logging
• Working knowledge of application security and secure development practices, including OWASP Top 10, dependency and vulnerability scanning, penetration testing, and secure SDLC (strong plus)
• Working knowledge of physical security technologies including video management and IP camera platforms and access control and badge systems (e.g., Genetec, Milestone, Avigilon, Verkada, Lenel, or similar), plus network, hardening, and data protection considerations
• Familiarity with AI-based detection and video analytics capabilities and their operational, accuracy, and privacy implications (strong plus)
• Demonstrated experience implementing, achieving, or maintaining ISO 27001 certification (or comparable frameworks such as SOC 2, NIST CSF, or NIST 800-53), including risk assessment, control implementation, evidence collection, and audit support
• Direct experience completing client and third-party cyber security surveys and security questionnaires (e.g., CAIQ, SIG, HECVAT, or custom formats) and maintaining the evidence repository
• Understanding of privacy and data protection requirements (e.g., CCPA/CPRA, GDPR, and BIPA) as they apply to surveillance, biometric, and access control data
• Familiarity with ITIL operational processes (incident, problem, change, configuration management) and ability to work effectively in a structured operations environment
• Industry certifications preferred (examples include ISO 27001 Lead Implementer, CISSP, AWS Certified Security – Specialty, Ping Identity Certified Professional - PingOne, Jamf Certified Tech, or CompTIA Security+)
• Excellent documentation, analytical, troubleshooting, and communication skills, with the ability to explain security requirements to technical and non-technical audiences and provide high customer service
• Dependable team player with business maturity, enthusiasm, and ability to work independently and collaboratively

Additional Information

• Private Detective #28063
• Private Patrol Operator #13936