Sr. Security Analyst

About the Role

BDA is seeking a Senior Security Analyst to strengthen our security program and transition from a reactive to a proactive security strategy. This role focuses on application, cloud, and infrastructure security, involving vulnerability identification, testing, and risk reduction across the organization. You'll also help define BDA's red-team security function. We welcome both experienced mid-level professionals with strong application security skills and seasoned security experts seeking broad ownership and challenges.

Responsibilities

• Conduct vulnerability scans, penetration testing, and security assessments across applications, systems, cloud environments, and infrastructure.
• Use tools like Tenable Nessus, Burp Suite, and CrowdStrike to identify vulnerabilities, investigate threats, and recommend remediation.
• Test web applications for potential exploits, attack paths, and security weaknesses.
• Evaluate the security of Linux-based and cloud environments, including AWS, OCI, and Azure.
• Partner with infrastructure and engineering teams to improve system configurations, hardening standards, access controls, and overall security posture.
• Monitor security events, investigate incidents, and support incident response and forensic activities.
• Conduct account reviews, access reviews, risk assessments, and other security-related analysis.
• Develop clear reports and recommendations for technical teams, business leaders, and executive stakeholders.
• Help establish repeatable security processes, priorities, and testing practices for proactive risk management.
• Collaborate with security team members, consultants, IT infrastructure, engineering, legal, compliance, and business teams.
• Support the development and improvement of security policies, procedures, standards, and employee awareness initiatives.
• Stay current on emerging threats, vulnerabilities, attack methods, and security best practices.

Qualifications

• Bachelor’s degree in Computer Science, Information Technology, Cybersecurity, or a related field.
• Professional experience in information security, application security, infrastructure security, or a closely related area.
• Hands-on experience with Microsoft Defender, Microsoft Purview, CrowdStrike, Tenable Nessus, and Burp Suite.
• Proven experience with application and environment security, vulnerability testing, exploit testing, penetration testing, or vulnerability scanning.
• Strong understanding of cloud security and experience securing AWS, OCI, or Azure environments.
• Experience working with Linux environments and securing cloud-based or distributed infrastructure.
• Knowledge of security frameworks and standards such as NIST, CIS, or ISO 27001.
• Understanding of risk management practices and ability to identify, prioritize, and communicate security risks.
• Working knowledge of security technologies like firewalls, IDS/IPS, endpoint security, SIEM, and enterprise intrusion-prevention systems.
• Experience with system-hardening standards for servers, desktops, laptops, or network devices.
• Understanding of malware, attack vectors, network threats, incident response, authentication, and access-control technologies.
• Knowledge of internet protocols and security technologies, including HTTP, TLS, SSL, HTML, and XML.
• Understanding of cloud, container-based, and virtualized architectures.
• Knowledge of encryption techniques, standards, and appropriate encryption levels.
• Strong analytical, problem-solving, and attention-to-detail skills.
• Clear communication skills and ability to work across technical and nontechnical teams.
• Collaborative and humble working style, with ability to accept direction and remain open to others' perspectives.

Preferred Qualifications

• Previous experience in IT infrastructure, systems administration, networking, DevOps, or engineering before moving into security.
• Experience combining technical security with governance, risk, compliance, or privacy responsibilities.
• Familiarity with privacy regulations such as GDPR, CPRA, or CCPA.
• Experience with firewalls, load balancers, web application firewalls, or VPN concentrators.
• Experience with databases and technologies like Elasticsearch, SQL, or Oracle.
• Experience handling and protecting information across different sensitivity levels.
• Familiarity with standards or regulations like FISMA, GLBA, FERPA, PCI DSS, ISO, or NIST.
• Higher education or government information-security experience.
• Security certifications such as CISSP, CISA, CISM, CEH, GWAPT, GPEN, CSFA, or similar.
• Experience with SUMO Cloud or comparable security monitoring and log-analysis tools.

Pay

The base salary range for this position is $120,000 to $130,000. Compensation will be determined based on factors including geographic location, skills, education, and experience. This range is one component of BDA’s total compensation and rewards programs, which also includes robust PTO, medical/dental/vision insurance, 401k, tuition reimbursement, and professional development opportunities.

Schedule

This role is based in Woodinville, WA, requiring 4 days onsite and 1 day remote. Candidates must live within commuting distance for regular in-person collaboration.

Why BDA?

BDA is a creative, collaborative, and customer-focused company with over 40 years of experience helping iconic brands through branded merchandise and custom programs. Our core values emphasize teamwork, innovation, and a "get it done" mindset, while fostering creativity, growth, and meaningful impact. We value family, flexibility, and a vibrant, welcoming culture that celebrates diversity.