IT Security Analyst II
for each section heading. Use - for any list of duties/requirements/benefits. Use
for prose.
We must not include filler like "commensurate with experience". Not present.
We need to include Pay and Schedule sections only if posting states them. Yes: Pay Range $108,139.20 - $141,294.40 and Scheduled Weekly Hours 40.
We need to include Benefits section: list of benefits.
We need to include About the role: maybe from Position Overview summary.
Let's extract:
Position Overview SUMMARY (Basic Purpose of the Job): The IT Security Analyst II independently owns and manages core information security programs, including third-party risk management (TPRM), Security Awareness Training, and Application Security Assessments. This role serves as a trusted resource for staff and leaders regarding information security policy implementation, interpretation, and compliance, and drafts and maintains information security policies, standards, and procedures. Building on the foundation of the IT Security Analyst I role, this position operates with greater autonomy, owns end-to-end programs and initiatives, and provides mentorship and guidance to less experienced team members. The position assesses and prioritizes information security and cybersecurity risk across the organization, facilitates compliance with regulatory requirements and information security policies, and develops and reports on information security metrics.
That's prose.
Minimum Requirements: Education: Bachelor's degree in a relevant field or equivalent experience. Experience: Three years demonstrated experience in cybersecurity, GRC, vulnerability management, TPRM, or related roles, including experience gained as an IT Security Analyst I or in an equivalent role required. Working knowledge of NIST CSF, HIPAA, or other security/regulatory frameworks required. CompTIA Security+ required. One or more mid-level certifications such as CompTIA CySA+ or ISACA CRISC preferred (or equivalent). Progress toward or attainment of ISACA CISM, CISA, or ISC2 CISSP is a plus.
Knowledge and Skills: Strong working knowledge of desktop, server, storage, virtualization, networking, and security technologies. Demonstrated ability to independently lead risk assessments, vendor risk reviews, and vulnerability remediation efforts, and to translate technical findings into business risk language for non-technical stakeholders. Special Training: A+, Network+, Security+, CySA+, CRISC, or other relevant IT security certifications are a plus. Mental, Behavioral and Emotional Abilities: Ability to work independently with minimal supervision, exercise sound judgment on risk-based decisions, mentor junior staff, and communicate effectively with both technical and non-technical audiences under time-sensitive conditions.
Essential Functions: list many bullet-like sentences. We'll turn each sentence into
- .
Benefits: list: Medical Plan, Prescription drug coverage & In-House Employee Pharmacy, Dental Plan, Vision Plan, Flexible Spending Account (FSA) Healthcare FSA Dependent Care FSA, Retirement Savings and Investment Plan, Basic Group Term Life and Accidental Death & Dismemberment (AD&D) Insurance, Supplemental Group Term Life & Accidental Death & Dismemberment Insurance, Disability Benefits – Long Term Disability (LTD), Disability Benefits – Short Term Disability (STD), Employee Assistance Program, Commuter Transit, Commuter Parking, Supplemental Life Insurance Voluntary Life Spouse Voluntary Life Employee Voluntary Life Child, Voluntary Legal Services, Voluntary Accident, Critical Illness and Hospital Indemnity Insurance, Voluntary Identity Theft Insurance, Voluntary Pet Insurance, Paid Time-Off Program.
Pay: Pay Range $108,139.20 - $141,294.40. Also maybe mention that listed pay range reflects compensation for full-time equivalent (1.0 FTE) position. Actual compensation may differ depending on assigned hours and position status (e.g., part-time). We'll include that as prose.
Schedule: Scheduled Weekly Hours 40.
Physical Demands and Work Environment maybe not required as a section; we could omit because not in allowed headings. The instruction: Use headings for section headings (e.g. About the role, Responsibilities, Requirements, Qualifications, Skills, Benefits, Pay, Schedule). It doesn't say we must include all; we include only those with content. Physical Demands not in list, so we omit.
Now produce HTML fragment.
Structure:
About the role
... (position overview)
Responsibilities
- Owns and manages the third-party risk management (TPRM) program end-to-end, including vendor classification logic, risk scoring methodology, intake routing/workflows, assessment questionnaires, and reassessment tracking; serves as the primary point of contact for vendor risk questions across the organization.
- Independently drives vendor risk assessments from initial outreach through closure, including follow-up with unresponsive vendors, review of vendor-submitted documentation, and escalation of high-risk or unresolved vendor relationships to leadership.
- Administers the organization's enterprise phishing simulation program, including campaign design and scheduling, execution, data collection, results analysis, and reporting of metrics and trends to leadership.
- Performs Application Security Assessments for new and existing software, evaluating security posture and providing risk-based recommendations to stakeholders.
- Owns and manages the software request and review process, evaluating new software and vendor tools for security risk prior to approval and onboarding.
- Provides broader support to overall GRC program strategy and planning, partnering with the IT Manager on initiatives such as multi-campaign phishing simulation roadmaps, TPRM process improvements, and team capacity/workload planning for a small, high-throughput GRC team.
- Researches, drafts, and maintains information security policies, standards, procedures, and performs detailed policy reviews. Tracks and reports on remediation progress for regulatory and framework-based gap assessments (e.g., HIPAA Security Rule), maintaining a remediation tracker and coordinating with control owners to close identified gaps.
- Develops and maintains security awareness training content for staff and management audiences, including designing and updating training presentation materials with current statistics and emerging threat topics.
- Coordinates examinations by qualified security assessors for regulations and frameworks such as HIPAA and NIST, working with control owners and external assessors to ensure evidence requests are completed timely and accurately.
- Monitors security alerts, analyzes incidents, and contributes to incident response activities in coordination with the Security Operations team and IT Manager.
- Manages the exception review and approval process, ensuring exceptions are documented, risk-rated, and reviewed on schedule.
- Applies current threat intelligence and security trends to inform TPRM, awareness training, and policy work.
- Collaborates closely with the IT Manager and Security Operations team on day-to-day operational challenges and contributes to effective, sustainable solutions as part of a small, high-throughput GRC team.
- Mentors and provides guidance to IT Security Analyst I team members and other GRC support staff, including knowledge transfer, review of work products, and onboarding support; serves as a go-to resource for procedural and technical questions within the GRC team.
- Maintains comprehensive documentation of TPRM activities, vendor assessments, security awareness training and phishing simulation activities, and policy review work.
- Generates and analyzes regular reports on information security metrics (e.g., phishing simulation results, vendor assessment status, remediation tracking) for management review, identifying trends and improvement opportunities.
- Fosters a culture of security awareness and best practices within the organization.
- Stays informed of industry best practices, emerging threats, and advancements in cybersecurity, and pursues relevant certifications and training to enhance expertise.
- Performs other duties as assigned.
Requirements
Education: Bachelor's degree in a relevant field or equivalent experience.
Experience: Three years demonstrated experience in cybersecurity, GRC, vulnerability management, TPRM, or related roles, including experience gained as an IT Security Analyst I or in an equivalent role required.
Working knowledge of NIST CSF, HIPAA, or other security/regulatory frameworks required.
CompTIA Security+ required.
One or more mid-level certifications such as CompTIA CySA+ or ISACA CRISC preferred (or equivalent).
Progress toward or attainment of ISACA CISM, CISA, or ISC2 CISSP is a plus.
Alternatively could combine into but each is separate line; but instruction: Use - for any list of duties/requirements/benefits. So we should put requirements as list. Let's do:
Requirements
- Education: Bachelor's degree in a relevant field or equivalent experience.
- Experience: Three years demonstrated experience in cybersecurity, GRC, vulnerability management, TPRM, or related roles, including experience gained as an IT Security Analyst I or in an equivalent role required.
- Working knowledge of NIST CSF, HIPAA, or other security/regulatory frameworks required.
- CompTIA Security+ required.
- One or more mid-level certifications such as CompTIA CySA+ or ISACA CRISC preferred (or equivalent).
- Progress toward or attainment of ISACA CISM, CISA, or ISC2 CISSP is a plus.
Skills
Strong working knowledge of desktop, server, storage, virtualization, networking, and security technologies.
Demonstrated ability to independently lead risk assessments, vendor risk reviews, and vulnerability remediation efforts, and to translate technical findings into business risk language for non-technical stakeholders.
Special Training: A+, Network+, Security+, CySA+, CRISC, or other relevant IT security certifications are a plus.
Mental, Behavioral and Emotional Abilities: Ability to work independently with minimal supervision, exercise sound judgment on risk-based decisions, mentor junior staff, and communicate effectively with both technical and non-technical audiences under time-sensitive conditions.
Alternatively could list as . But it's okay as prose.
Benefits
- Medical Plan
- Prescription drug coverage & In-House Employee Pharmacy
- Dental Plan
- Vision Plan
- Flexible Spending Account (FSA) Healthcare FSA Dependent Care FSA
- Retirement Savings and Investment Plan
- Basic Group Term Life and Accidental Death & Dismemberment (AD&D) Insurance
- Supplemental Group Term Life & Accidental Death & Dismemberment Insurance
- Disability Benefits – Long Term Disability (LTD)
- Disability Benefits – Short Term Disability (STD)
- Employee Assistance Program
- Comm
for prose. We must not include filler like "commensurate with experience". Not present. We need to include Pay and Schedule sections only if posting states them. Yes: Pay Range $108,139.20 - $141,294.40 and Scheduled Weekly Hours 40. We need to include Benefits section: list of benefits. We need to include About the role: maybe from Position Overview summary. Let's extract: Position Overview SUMMARY (Basic Purpose of the Job): The IT Security Analyst II independently owns and manages core information security programs, including third-party risk management (TPRM), Security Awareness Training, and Application Security Assessments. This role serves as a trusted resource for staff and leaders regarding information security policy implementation, interpretation, and compliance, and drafts and maintains information security policies, standards, and procedures. Building on the foundation of the IT Security Analyst I role, this position operates with greater autonomy, owns end-to-end programs and initiatives, and provides mentorship and guidance to less experienced team members. The position assesses and prioritizes information security and cybersecurity risk across the organization, facilitates compliance with regulatory requirements and information security policies, and develops and reports on information security metrics. That's prose. Minimum Requirements: Education: Bachelor's degree in a relevant field or equivalent experience. Experience: Three years demonstrated experience in cybersecurity, GRC, vulnerability management, TPRM, or related roles, including experience gained as an IT Security Analyst I or in an equivalent role required. Working knowledge of NIST CSF, HIPAA, or other security/regulatory frameworks required. CompTIA Security+ required. One or more mid-level certifications such as CompTIA CySA+ or ISACA CRISC preferred (or equivalent). Progress toward or attainment of ISACA CISM, CISA, or ISC2 CISSP is a plus. Knowledge and Skills: Strong working knowledge of desktop, server, storage, virtualization, networking, and security technologies. Demonstrated ability to independently lead risk assessments, vendor risk reviews, and vulnerability remediation efforts, and to translate technical findings into business risk language for non-technical stakeholders. Special Training: A+, Network+, Security+, CySA+, CRISC, or other relevant IT security certifications are a plus. Mental, Behavioral and Emotional Abilities: Ability to work independently with minimal supervision, exercise sound judgment on risk-based decisions, mentor junior staff, and communicate effectively with both technical and non-technical audiences under time-sensitive conditions. Essential Functions: list many bullet-like sentences. We'll turn each sentence into
About the role
... (position overview)
Responsibilities
- Owns and manages the third-party risk management (TPRM) program end-to-end, including vendor classification logic, risk scoring methodology, intake routing/workflows, assessment questionnaires, and reassessment tracking; serves as the primary point of contact for vendor risk questions across the organization.
- Independently drives vendor risk assessments from initial outreach through closure, including follow-up with unresponsive vendors, review of vendor-submitted documentation, and escalation of high-risk or unresolved vendor relationships to leadership.
- Administers the organization's enterprise phishing simulation program, including campaign design and scheduling, execution, data collection, results analysis, and reporting of metrics and trends to leadership.
- Performs Application Security Assessments for new and existing software, evaluating security posture and providing risk-based recommendations to stakeholders.
- Owns and manages the software request and review process, evaluating new software and vendor tools for security risk prior to approval and onboarding.
- Provides broader support to overall GRC program strategy and planning, partnering with the IT Manager on initiatives such as multi-campaign phishing simulation roadmaps, TPRM process improvements, and team capacity/workload planning for a small, high-throughput GRC team.
- Researches, drafts, and maintains information security policies, standards, procedures, and performs detailed policy reviews. Tracks and reports on remediation progress for regulatory and framework-based gap assessments (e.g., HIPAA Security Rule), maintaining a remediation tracker and coordinating with control owners to close identified gaps.
- Develops and maintains security awareness training content for staff and management audiences, including designing and updating training presentation materials with current statistics and emerging threat topics.
- Coordinates examinations by qualified security assessors for regulations and frameworks such as HIPAA and NIST, working with control owners and external assessors to ensure evidence requests are completed timely and accurately.
- Monitors security alerts, analyzes incidents, and contributes to incident response activities in coordination with the Security Operations team and IT Manager.
- Manages the exception review and approval process, ensuring exceptions are documented, risk-rated, and reviewed on schedule.
- Applies current threat intelligence and security trends to inform TPRM, awareness training, and policy work.
- Collaborates closely with the IT Manager and Security Operations team on day-to-day operational challenges and contributes to effective, sustainable solutions as part of a small, high-throughput GRC team.
- Mentors and provides guidance to IT Security Analyst I team members and other GRC support staff, including knowledge transfer, review of work products, and onboarding support; serves as a go-to resource for procedural and technical questions within the GRC team.
- Maintains comprehensive documentation of TPRM activities, vendor assessments, security awareness training and phishing simulation activities, and policy review work.
- Generates and analyzes regular reports on information security metrics (e.g., phishing simulation results, vendor assessment status, remediation tracking) for management review, identifying trends and improvement opportunities.
- Fosters a culture of security awareness and best practices within the organization.
- Stays informed of industry best practices, emerging threats, and advancements in cybersecurity, and pursues relevant certifications and training to enhance expertise.
- Performs other duties as assigned.
Requirements
Education: Bachelor's degree in a relevant field or equivalent experience.
Experience: Three years demonstrated experience in cybersecurity, GRC, vulnerability management, TPRM, or related roles, including experience gained as an IT Security Analyst I or in an equivalent role required.
Working knowledge of NIST CSF, HIPAA, or other security/regulatory frameworks required.
CompTIA Security+ required.
One or more mid-level certifications such as CompTIA CySA+ or ISACA CRISC preferred (or equivalent).
Progress toward or attainment of ISACA CISM, CISA, or ISC2 CISSP is a plus.
Alternatively could combine into- but each is separate line; but instruction: Use
- for any list of duties/requirements/benefits. So we should put requirements as list. Let's do:
Requirements
- Education: Bachelor's degree in a relevant field or equivalent experience.
- Experience: Three years demonstrated experience in cybersecurity, GRC, vulnerability management, TPRM, or related roles, including experience gained as an IT Security Analyst I or in an equivalent role required.
- Working knowledge of NIST CSF, HIPAA, or other security/regulatory frameworks required.
- CompTIA Security+ required.
- One or more mid-level certifications such as CompTIA CySA+ or ISACA CRISC preferred (or equivalent).
- Progress toward or attainment of ISACA CISM, CISA, or ISC2 CISSP is a plus.
Skills
Strong working knowledge of desktop, server, storage, virtualization, networking, and security technologies.
Demonstrated ability to independently lead risk assessments, vendor risk reviews, and vulnerability remediation efforts, and to translate technical findings into business risk language for non-technical stakeholders.
Special Training: A+, Network+, Security+, CySA+, CRISC, or other relevant IT security certifications are a plus.
Mental, Behavioral and Emotional Abilities: Ability to work independently with minimal supervision, exercise sound judgment on risk-based decisions, mentor junior staff, and communicate effectively with both technical and non-technical audiences under time-sensitive conditions.
Alternatively could list as- . But it's okay as prose.
- Medical Plan
- Prescription drug coverage & In-House Employee Pharmacy
- Dental Plan
- Vision Plan
- Flexible Spending Account (FSA) Healthcare FSA Dependent Care FSA
- Retirement Savings and Investment Plan
- Basic Group Term Life and Accidental Death & Dismemberment (AD&D) Insurance
- Supplemental Group Term Life & Accidental Death & Dismemberment Insurance
- Disability Benefits – Long Term Disability (LTD)
- Disability Benefits – Short Term Disability (STD)
- Employee Assistance Program
- Comm
Benefits