INFORMATION SECURITY ANALYST

The Information Security Analyst is a technical position within the IT department.

The primary function of this position is to operate and maintain Nox Group’s information security program under the direction of the Director of IT, who retains ownership of the program and of all systems and infrastructure. The Director of IT sets the program’s priorities and focus areas, approves all policies and standards, and makes the go or no-go decision on recommended remediation and program changes. The Information Security Analyst monitors and responds to security events, maintains the Information Security Management System (ISMS) and its registers, coordinates vulnerability remediation, maintains incident response and disaster recovery plans, governs identity and data access, and owns compliance and insurance evidence. The position is the day-to-day internal point of contact for security matters and turns findings into assigned, documented, and closed work.

ESSENTIAL DUTIES & RESPONSIBILITIES

Security Operations & Incident Response:

• Investigate phishing, suspicious sign-ins, identity risk detections, and malicious domains. Sophos MDR is the primary detection and response layer, but Microsoft Defender, Entra identity protection, and Egnyte Secure & Govern can trigger first; the Analyst investigates and contains regardless of which platform alerted.
• Own the phishing report process: triage employee-reported emails, determine whether they are malicious, coordinate blocking and cleanup, and give reporters timely feedback.
• Respond in the order set by the Incident Response Plan: stop the active threat (secure accounts, isolate devices, block senders and domains), then contain and recover, then find the root cause and fix the system or process. Containment is taken on the Analyst’s own judgment within approved procedure and does not wait for prior approval.
• Maintain and annually review the Incident Response Plan: severity model, roles, decision authority for system shutdowns and for insurer, legal, customer, and employee communication, escalation paths, communication templates, and response SOPs.
• Plan and facilitate tabletop exercises with IT, Finance, Legal, and leadership (for example ransomware and business email compromise payment fraud); run post-incident reviews and track corrective actions to completion.

Disaster Recovery & Business Continuity: Maintain the ability to recover

• Maintain the Disaster Recovery Plan for Director approval: recovery priorities, recovery time and recovery point objectives, and restoration runbooks for critical systems.
• Coordinate backup verification and periodic restore and failover testing with the IT Systems Engineer, who operates the backup platform; document results and track gaps to closure.
• Work with department leaders on business continuity procedures so operations can continue during an outage or incident.

Governence & ISMS: Maintain the Information Security Management System

• Draft policies, standards, and procedures (acceptable use, access control, data handling, remote and mobile device use, and others) for review and approval by the Director of IT; the Director approves policy, sets priorities, and accepts risk.
• Document security procedures in the Nox Group Standard Works format so they are consistent and repeatable across subsidiaries.
• Keep the Risk, Exception, Compliance Obligations, CIS Control Mapping, and Vulnerability Advisory registers current and reviewed on a defined cadence; run the policy exception process.
• Measure program maturity against the CIS Controls and NIST Cybersecurity Framework and recommend prioritized improvements for the program roadmap.

Vulnerability Management: Run the vulnerability lifecycle

• Review platform findings and vendor advisories, confirm applicability and impact, and present recommended remediation and target dates to the Director of IT for approval.
• Track approved remediation to closure and retain evidence; coordinate approved patch targets with the IT Systems Engineer, who owns the patch lifecycle.
• Coordinate external assessments, including PCI ASV scanning and penetration testing, and manage the findings.

Identity & Access Governance: Govern access across the hybrid identity environment

• Coordinate periodic access reviews of users, privileged roles, service accounts, and shared resources with IT and department leaders; drive removal of excess access.
• Recommend requirements for MFA, passwordless authentication, Conditional Access, and privileged access for Director approval; the IT Systems Engineer administers the controls.
• Review the joiner, mover, and leaver process for security gaps and verify offboarding is complete.

Data Protection: Maintain data security requirements

• Maintain data classification, protection, retention, and recovery requirements and verify they are applied across file, email, and endpoint platforms.
• Review data loss prevention, external sharing, and guest access findings and coordinate corrective action.

Vendor & Third-Party Risk: Oversee security vendors and assess third parties

• Serve as the day-to-day contact for the MDR provider; review its reporting on a regular cadence and verify escalation contacts, response authority, and coverage (jobsite devices, subsidiaries, cloud tenants) stay current.
• Perform security reviews of new software, SaaS, and vendors before adoption; document exceptions.

Compliance & Customer Assurance: Prepare evidence and support reviews

• Own evidence and responses for customer, prime contractor, and cyber insurance security questionnaires, customer prequalification applications, and PCI DSS obligations.
• Support audits and customer security reviews, including those from data center clients.

Security Awareness: Run the awareness program

• Administer onboarding training, phishing simulations through Sophos Phish Threat, and targeted training for finance, field, and executive staff; track completion and follow up with teams that need support.
• Use phishing report volume and simulation trends to shape training and awareness messaging; report results to IT leadership.

Reporting & Coordinator: Maintain visibility and work across the business

• Communicate proactively with the Director of IT on program status, open risks, and upcoming deliverables; produce regular reporting on incidents, vulnerabilities, access reviews, and awareness results for the Director of IT and CIO.
• Maintain security documentation, runbooks, and knowledge-base articles.
• Partner with Legal, Accounting, People Operations, Safety, Procurement, department leaders, and executives to put security procedures into practice; coordinate with the IT Manager when IT Technicians are needed for remediation work.
• Evaluate security tooling and services and present options and recommendations to the Director of IT; the Director decides what is adopted.

Other Duties: Perform other duties as assigned.

 

QUALIFICATIONS

Experience & Technical Qualifications

• Entry-level position; relevant internship, co-op, or project experience in IT, cybersecurity, security operations, or compliance preferred.
• Experience developing, writing, or maintaining policies, standard operating procedures (SOPs), or training materials is a plus.
• Familiarity with cybersecurity frameworks, including NIST Cybersecurity Framework (CSF), CIS Controls, or ISO 27001 preferred.
• Understanding of cybersecurity fundamentals, including access control, incident response, risk management, and common cyber threats such as phishing, ransomware, and business email compromise.
• Proficiency with Microsoft 365, SharePoint, and Microsoft Office applications for documentation, reporting, and document management.
• Exposure to Microsoft Entra ID, Microsoft Defender, Sophos Central, and Egnyte Secure & Govern preferred.
• Experience with PowerShell and Microsoft Graph for querying systems, gathering evidence, and supporting security operations is a plus.

Core Competencies

• Analytical Judgment: Investigate ambiguous events, separate real threats from noise, and make sound containment decisions under pressure.
• Process Discipline: Follow and maintain documented procedures; keep registers, evidence, and closure records complete and current; organized and self-directed.
• Communication: Explain risk and required actions in plain language to field crews, project teams, and executives across multiple operating companies; turn technical requirements into clear procedures that non-technical staff can follow.
• Skill Development: Stay current with the threat landscape, Microsoft and Sophos security capabilities, and the CIS and NIST frameworks.
• Ability to analyze incomplete information, exercise independent judgment on severity and containment, maintain confidentiality, communicate clearly under pressure, and manage documentation, deadlines, and follow-ups without close supervision.

Physical Requirements & Travel

• Ability to perform physical activities as needed, including walking, climbing, stooping, reaching, lifting, and bending.
• Must be able to lift and/or move up to 50 pounds.
• Willingness and ability to travel occasionally to job sites and branch offices.

Eduation

• Bachelor’s degree in Cybersecurity, Information Systems, Computer Science, or a related field preferred; equivalent practical experience will be considered.
• CompTIA Security+ must be attained within 12 months of hire.

 

Safety Level 

This is a safety sensitive position, and all applicable policies including drug test and background check will apply.

• The inherent responsibilities of your role may include physical working conditions. In order to safely and successfully perform job duties you must be able to:  
• Potentially lift up to 50 pounds 
• Potentially need to do repeated pushing, pulling, carrying, reaching (or working above shoulder), walking, standing, sitting, stooping, kneeling, bending, and climbing  
• Potentially operate a motor vehicle, crane, tractor, etc.  
• We reserve the right to continually monitor your ability to safely and successfully complete these inherent physical responsibilities and take action as deemed appropriate in accordance with the Americans with Disability Act (ADA)