Cyber Security Analyst III/Senior

The selected candidate will support the Cybersecurity Analytics Support Team (CAST) function by actively working with CAST personnel, supervisory staff and Board of Governors' staff concerning ongoing cyber incidents within supervised institutions as well as emerging threats potentially impacting the United States financial sector. This individual would have experience and/or expertise in multiple cybersecurity subject matter areas:

• Cybersecurity related frameworks such as NIST 800-53, NIST Cybersecurity Framework (CSF), IS 27001, MITRE ATT&CK, etc.
• Assessing cybersecurity threats, vulnerabilities, and related exploitation activity; recommending related mitigations to manage risk to computing environments.
• Tracking and reporting on threat actor groups that potentially pose a threat to the United States financial sector.
• Cloud services and providers such as Amazon Web Services, Microsoft Azure, and Google Cloud Platform.
• Incident management and response activities related to cybersecurity events.
• Security architecture and design implementation to mitigate threats against confidentiality, integrity, and availability., * Conducts analysis and interpreting of cybersecurity threats to identify trends and emerging risks.
• Provide input and insight into response activities during cyber incidents to include best practices from regulatory bodies, cybersecurity organizations, and NIST.
• Conducts formal assessments to determine the severity of reported cybersecurity incidents at financial institutions.
• Prepares in written form research, analysis, and assessments for key internal stakeholders as needed or requested. Analysis supports recommendations regarding cybersecurity threats, threat vectors, threat actors and threat trends.
• Demonstrates knowledge of cybersecurity threats within the broader financial sector and related industries.
• Assist bank supervision examination teams, the central point of contact teams, and examiners-in-charge during active cybersecurity incidents at regulated banking/financial institutions.
• Build and maintain relationships with central points of contact teams, examiners, and board staff across the Federal Reserve System.
• Communicate appropriate information to the Supervision & Regulation staff at the Federal Reserve Bank and Board levels to maintain a comprehensive understanding of ongoing incidents and ensure appropriate steps are taken to isolate any potential residual effects from a cyber incident.
• Participates in knowledge sharing forums related to key cybersecurity risks and emerging issues.
• Participates in efforts to advance Reserve Bank or System strategic initiatives.
• Provides leadership, coaching, and mentoring for less experienced analysts on processes and procedures related to internal matters and the supervisory process.
• Weekend on-call support is part of the position on a rotating basis (generally once every 12 weeks)
• Performs other duties as assigned or requested., The expected starting salary range for the Cyber Security Analyst III is between $111,400 and $139,200 annually and for the Cyber Security Analyst Senior is between $137,000 and $171,300. Final salary and offer will be determined by the applicant's background, experience, skills, internal equity, and market data.

The Cleveland Fed offers benefits to support overall health and financial security. Learn more about our benefits here: https://www.clevelandfed.org/careers

Physical Demands and General Working Conditions

This is not necessarily an exhaustive list of all responsibilities, duties, standards or requirements, efforts, skills or working conditions associated with the job. While this is intended to be an accurate reflection of the current job, the Federal Reserve Bank of Cleveland reserves the right to revise this or any job description at any time.

Reasonable Accommodation Statement - The Federal Reserve Bank of Cleveland is committed to ensuring that individuals with disabilities are provided with reasonable accommodation to participate in the job application or interview process, perform essential job functions, and receive other benefits and privileges of employment. To request a reasonable accommodation for any part of the employment process, please send an email to clev.4d.benefits.specialist@clev.frb.org.

Bank's Ethics Rules and Drug Testing:

As a condition of employment, Federal Reserve Bank of Cleveland employees must comply with the Bank's ethics rules which generally prohibit employees, their spouses/domestic partners, and minor children from owning or controlling, directly or indirectly, any debt or equity interest in a depository institution or an affiliate of a depository institution. A "depository institution" means a bank, a trust company, or any institution that accepts deposits, including a bank chartered under the laws of a foreign country. In addition, employees (and their spouses/domestic partners, and minor children) may not own shares of mutual funds, unit investment trusts or ETFs that have a policy, as stated in the prospectus, of concentrating in the financial services industry and that have underlying investments in banks or other depository institutions. If you or your spouse/domestic partner or minor child own such securities and would not be willing or able to divest them if you accepted an offer of Bank employment, you should raise this issue with the recruiter for this posting.

Analyst III: Bachelor's degree in computer science, Management Information Systems or related field and 7+ years of related work experience required OR Master's Degree and 5+ years of professional work experience.

• Advanced ability to perform independent research and provide written reports summarizing findings and analysis.
• Intermediate knowledge of regulations, procedures, and practices of a specific discipline (e.g., bank examinations, information security, cyber intelligence).
• Advanced problem solving and analytical thinking.
• Advanced specialized operational/technical skills in cyber intelligence and information security.
• Intermediate knowledge of Microsoft Office; general proficiency in Word, PowerPoint and Excel.
• Intermediate knowledge of project management.
• Intermediate ability to analyze information and demonstrate findings with written reports, data visualizations, graphs/charts, or presentations.

Senior Analyst: Bachelor's degree in computer science, Management Information Systems or related field and 10+ years of related work experience required OR Master's Degree and 7+ years of professional work experience.

• Advanced ability to perform independent research and provide written reports summarizing findings and analysis.
• Intermediate knowledge of regulations, procedures, and practices of a specific discipline (e.g., bank examinations, information security, cyber intelligence).
• Advanced problem solving and analytical thinking.
• Advanced specialized operational/technical skills in cyber intelligence and information security.
• Intermediate knowledge of Microsoft Office; general proficiency in Word, PowerPoint and Excel.
• Intermediate knowledge of project management.
• Intermediate ability to analyze information and demonstrate findings with written reports, data visualizations, graphs/charts, or presentations.

Knowledge Areas

• Expert knowledge of regulations, procedures and practices of a specific discipline (e.g. information security, cyber intelligence).
• Advanced ability to perform independent research.
• Advanced knowledge of project management.
• Intermediate knowledge of Microsoft Office.
• Advanced knowledge of intelligence concepts; intelligence lifecycle, diamond method, structured analytic techniques (red team, devil's advocate, analysis of competing hypothesis).
• Advanced knowledge in: NIST, ITIL, COBIT, guidelines, security analytics, network architecture / perimeter security, network monitoring and analysis, threat intelligence and advanced threats, authentication, secure coding / application development, penetration testing, cyber incident response, web based attacks and mitigations, cyber risk assessment and strategic analysis, vulnerability detection and assessment, mobile device management, and digital forensics and advanced security tools (e.g. DDoS, malware, DLP, MFA, SIEM, vulnerability scanning and patching).
• Advanced knowledge in areas of technology governance, technology risk management/GRC, internal audit, vendor/third-party management, business resiliency and fraud.
• Security operations concepts; perimeter defense, BYOD, data loss protection, insider threat, kill chain, risk assessment, etc.
• Relevant IT certifications (CISA, CISSP, CGEIT, CRISC, CRMA).

Skill Areas

• Expert problem solving and analytical
• Expert specialized operational/technical skills in cyber intelligence and information security
• Advanced written and verbal communication
• Advanced presentation
• Advanced public speaking
• Advanced strategic thinking/planning

Federal Reserve Bank of Cleveland The Federal Reserve Bank of Cleveland's mission is to foster the stability, integrity, and efficiency of the nation's monetary, financial, and payment systems while representing the Fourth District perspectives. As part of the nation's central bank, we are a team of mission-driven professionals who are committed to serving with excellence. Our core values are: Build Trust Every Day, Own Our Actions, Collaborate with Intention, and Be Open to Change. For twenty-six years in a row, we've been named "One of Northeast Ohio's Best Places to Work" by North Coast 99. This prestigious award honors organizations with outstanding employment practices, including compensation, benefits, training, recruitment, retention, community services, and employee communications. Follow us on LinkedIn, Twitter, Instagram, and our YouTube channel - Cleveland Fed, The Federal Reserve Banks are committed to equal employment opportunity for employees and job applicants in compliance with applicable law and to an environment where employees are valued for their differences.