Senior Information Security Analyst

Wells Fargo is seeking a Senior Information Security Analyst to support the Findings & Exposure Management Oversight team. The role provides independent oversight across the findings and exposure lifecycle, with a focus on risk-based prioritization, remediation monitoring, closure assurance, exposure reporting, and patch oversight.

Location and Work Model

• Location: Irving, TX (hybrid)
• Minimum experience: 3 years

Key Responsibilities

• Apply lifecycle standards and risk thresholds to findings, security exposures, patch risks, and exceptions from intake through closure or risk acceptance.
• Review intake records for completeness, risk-based prioritization, and assignment of accountable owners.
• Independently challenge remediation plans, milestones, exception rationale, and supporting evidence.
• Monitor remediation progress, identify barriers and missed commitments, and coordinate central escalation of overdue or material items.
• Validate closure evidence and support independent challenge of residual-risk acceptance rationale before closure or risk acceptance decisions.
• Analyze findings and exposure data to identify trends, aging, data-quality issues, and emerging risks.
• Support certified metrics, executive dashboards, and recurring reporting that connect materiality, trend, ownership, required action, and source records.
• Perform recurring data-quality reviews and reconciliations to assess record completeness, accuracy, ownership, and status.
• Support Patch Oversight by reviewing patch-not-deployed rationale, overdue approvals, PTS data quality, and escalation requirements.
• Contribute to targeted reviews, control effectiveness assessments, issue analysis, and continuous improvement of the oversight model.
• Prepare clear, decision-oriented communications for leadership and governance forums.
• Mentor and support less experienced team members to promote consistent application of oversight practices.

Required Qualifications

• 4+ years of Information Security Analysis experience, or equivalent demonstrated through one or a combination of work experience, training, military experience, or education.
• 3+ years of experience performing information security assessments, findings reviews, security reviews, or control evaluations.
• 3+ years of experience analyzing security risks, reviewing remediation plans, and escalating missed commitments.

Technologies

• NIST
• ISO 27001
• CIS Controls
• COBIT
• AWS
• Azure
• Google Cloud

Desired Qualifications

• 4+ years of experience in Information Security, Cybersecurity, Compliance, Findings Management, Vulnerability Management, or Information Security Analysis, or an equivalent combination of work experience, training, military experience, or education.
• 3+ years of experience interpreting and applying information security policies, standards, control requirements, or regulatory expectations.
• Experience with enterprise findings, issue, vulnerability, exposure, or patch management processes.
• Experience independently challenging remediation plans, exceptions, closure evidence, or residual-risk decisions.
• Experience with compliance reviews, data-quality reviews, or control effectiveness assessments.
• Experience developing security metrics, executive dashboards, trend reporting, or risk exposure analyses.
• Knowledge of information security frameworks and standards such as NIST, ISO 27001, CIS Controls, COBIT, or similar frameworks.
• Knowledge of vulnerability management, patch management, exception management, and remediation practices.
• Experience supporting regulatory, internal audit, or external audit examinations.
• Strong analytical and problem-solving skills, including reconciling data, identifying trends, assessing evidence, and translating information into actionable insights.
• Strong written and verbal communication skills, including presenting complex risk information to technical and non-technical audiences.
• Ability to build effective relationships, influence outcomes, and provide credible challenge while maintaining independent oversight.
• Bachelor’s degree in Information Security, Cybersecurity, Computer Science, Information Technology, Business, or a related field.
• Professional certification such as CISSP, CISM, CRISC, CISA, Security+, or a related certification.
• Knowledge of cloud security concepts and controls within AWS, Azure, or Google Cloud environments.

Job Expectations

• This position is not available for Visa sponsorship.
• This position requires working in a hybrid environment from one of the posted locations.
• There is no relocation allowance for this position.