Information Security Analyst

The Information Security Analyst is a mid-to-senior member of the Information Security team responsible for the day-to-day execution of the company's vulnerability management, security awareness/phishing, patch management, and security monitoring / incident response programs. This role works with a high degree of independence and exercises sound judgment on prioritization of risk. Given the confidentiality needs of this role, the highest levels of personal integrity, professionalism, judgment, and maturity are expected.

Key Responsibilities

·   Own vulnerability management end-to-end — scanning, risk-based prioritization, remediation with system/application owners, and dashboard reporting to leadership on progress and aging items.

·   Own security awareness and phishing simulation programs — campaigns, incident investigation and remediation, and recurring training content and communications.

·   Monitor SIEM/EDR alerts; triage, investigate, and respond to incidents, escalating to the Incident Response Team and performing forensic research/imaging as needed.

·   Maintain SIEM/EDR platform health, including log/event source connectivity, and evaluate and implement new technologies as needed.

·   Own patch management — testing, scheduling, and implementing upgrades — and report compliance status, partnering with Infrastructure and Desktop Support to close SLA gaps.

·   Serve on the vendor approval board, assessing security risk on incoming vendor/tool requests, including AI tools and platforms considered for adoption.

·   Monitor and assess security posture/configuration of cloud and SaaS platforms (HR, payroll, benefits, ATS, and other third-party tools).

·   Oversee Azure/Entra ID configuration — conditional access, MFA, and subscription/tenant hygiene — partnering with Infrastructure on changes.

·   Report information security metrics/KPIs to leadership on a recurring basis.

·   Respond to SSAE18 and client/vendor security questionnaires; support physical and logical security audits of vendor and remote sites.

·   Document and update information security standards, procedures, and policies as practices and threats evolve.

·   Support special projects — tool evaluations/demos, implementation and tuning of new technologies, automation of routine tasks — and other duties as assigned.

Required Skills & Experience

·   4-year degree in Technology, Business, or a related field, or an equivalent combination of relevant experience, education, and training.

·   4–7 years of information security experience, including hands-on vulnerability management and/or security monitoring / incident response.

·   Experience with vulnerability scanning/management tools (e.g., Tenable, Qualys, Rapid7) and reporting.

·   Experience administering and troubleshooting SIEM/EDR platforms, including log/event source health; solid understanding of incident response and threat/vulnerability management.

·   Experience with vendor risk assessments/security questionnaires as part of a vendor approval process, including basic awareness of AI/LLM-related data and security risk considerations.

·   Experience running phishing simulation/awareness training programs (e.g., KnowBe4, Proofpoint) and investigating phishing incidents.

·   Familiarity with cloud/SaaS security posture management (e.g., SSPM/CASB concepts) across third-party platforms.

·   Working knowledge of Azure/Entra ID administration, including conditional access, MFA, and subscription/tenant management.

·   Exposure to patch management tools and compliance reporting (e.g., SCCM, WSUS, Ivanti).

·   Strong background in operational computer and network security, scripting (primarily PowerShell), and Active Directory.

·   Working knowledge of IPS, network monitoring, identity and access management, risk assessments, and security auditing.

·   Strong working knowledge of relevant laws, regulations, and standards relating to information security.

·   Ability to work independently, prioritize competing risks, and communicate findings to technical and non-technical audiences.

Education and Professional Licensing or Certifications

·   4-year degree in Technology, Business, or a related field preferred; may be offset by relevant job experience.

·   One or more information security certifications preferred: Security+, CySA+, GCIH, or CISSP (or actively pursuing).

About CoAd

CoAd helps businesses navigate the complexities of workforce management through a combination of technology, expertise, and human support. Serving more than 17,000 clients nationwide, CoAd delivers payroll, HR, benefits administration, compliance support, workforce technology, and PEO services that help organizations simplify operations, support their employees, and drive growth.

Built on the belief that workforce solutions should be integrated, intuitive, and people-centered, CoAd empowers employers to manage their workforce with greater confidence while adapting to the evolving needs of today’s workplace.

EEO

CoAd is committed to providing equal employment opportunities to all employees and applicants without regard to race, color, religion, national origin, ancestry, citizenship status, age, sex (including pregnancy, childbirth, breast feeding and pregnancy-related medical conditions), gender, gender identity or expression, sexual orientation, marital status, uniform service member and veteran status, disability, genetic information, or any other characteristic protected by applicable federal, state, or local laws and ordinances.