We believe that the right opportunity can provide a huge jumpstart towards earned expertise. As our Information Security Analyst, you'll be part of the team responsible for maintaining the security and integrity of all data and systems in our Community First enterprise environment. This is an entry-level position where excellent mentorship and real-world applications will allow you to grow and mature your understanding of cyber security threats, technologies, and countermeasures. As you learn and grow, you'll have the opportunity to serve as a Subject Matter Expert (SME) and resource to other IT teams and CU leadership. You'll be part of the conversation when discussing and recommending security initiatives to manage risk or address enterprise information security issues. You'll have first-hand experience examining infrastructure and devices to identify security flaws and recommend fixes. Your work will also include analyzing security processes/procedures and recommending new technologies or updates to combat current threats/risks, monitoring event logs to identify anomalous activity, and taking the necessary action to protect all credit union systems and data. If all of this sounds like your idea of an engaging work environment...we should talk! As our Information Security Analyst, you'll: Provide members and staff with secure, reliable, efficient, and user-friendly systems that support short and long term objectives for Community First Manage information security systems that support business operations and member facing systems Collaborate with staff both internal and external to the department to provide system support and improvements that benefit either staff or members directly Assist in developing and documenting plans for securing systems that support the business objectives to either improve business functionality or provide enhancements for members Assist in business continuity planning and systems security for business and member facing systems as required Contribute to the regulatory compliance as assessed from risk assessments and audits; both internal and external Research changing trends in information security threats and technology in contrast to regulations to ensure Community First remains compliant while delivering competitive products and services for businesses and members Contribute to the implementation of Protective Controls through Vulnerability Management, System Hardening, Attack Surface Reduction programs Contribute to the implementation of Detective Controls through SIEM, log analysis, Threat hunting programs, network monitoring tools Support Information Security Incident Response events following the Community First Information Security program and procedure Contribute to the implementation, management, and documentation of security technologies deployed by

Community First:

SIEM, Firewalls, IPS, and other security-related devices. Work collaboratively with Community First IT teams to support Information Security goals and projects. Research and contribute to the secure technology infrastructure based on regulatory requirements and industry best practices Assist in developing and maintaining the Community First's Information Security Program; this includes answering staff questions about security, responding to security incidents, documenting processes and procedures, and preparing materials for ongoing security knowledge transfer to staff. Contribute to standards for documenting information systems and changes to them and for testing new systems and updates for current programs before they are put into production Obtain certifications or attend technology and/or other conferences to remain informed of new industry trends, strategies, and opportunities; with strong consideration of changes within the credit union industry Respond to Information Security Events outside business hours or during on-call support An ideal candidate will have a combination of: Bachelor's degree or a combination of education and relevant experience (Infrastructure or Information Security related) Have obtained or are pursuing a current Information Security certification (example: Security+, CySA+, GSEC) Functional knowledge of new and emerging technologies, systems, and resources in the industry.

Including but not limited to:

Knowledge and understanding of network infrastructure and associated network ports and protocols Knowledge and understanding of enterprise operating systems, server administration, and management Ability to develop and document repeatable processes and procedures. Awareness of or practical hands-on experience with SIEM & Vulnerability Management programs Awareness of the

MITRE ATT&CK

framework Prior experience working with a traditional Infrastructure or Information Security program or examples of similar work done as part of school, or other professional training programs Equal Opportunity Employer This employer is required to notify all applicants of their rights pursuant to federal employment laws. For further information, please review the Know Your Rights (https://www.eeoc.gov/poster) notice from the Department of Labor.