IT Security Analyst - Threat and Vulnerability Management Team

Details

The Threat and Vulnerability Management Team (TVM) helps protect Bloomberg by partnering with internal technical departments to ensure the confidentiality, integrity, and availability of Bloomberg systems and processed data. The team reports to the Chief Information Security Office (CISO), which oversees the technical security of Bloomberg products, systems, networks, and commercial applications.

The IT Security Analyst will help ensure that IT infrastructure and security processes are resilient against current threats. The role involves hunting for, exploit testing, analyzing, and assessing vulnerabilities across a broad range of technologies. The analyst will engage with technology partners to test assumptions about the organization's security posture, manage identified vulnerabilities through remediation, and collaborate with security engineering and incident response teams to set strategic direction for the enterprise Threat and Vulnerability Management program.

Responsibilities

• Perform IT security assessments and partner with security and IT professionals to assess the potential impact of vulnerabilities and determine appropriate mitigating controls.
• Build strong partnerships with technical teams to promote vulnerability-management best practices across traditional infrastructure and cloud environments.
• Understand business requirements and work with business partners to define solutions that meet security mandates and business needs.
• Help standardize workflows, processes, procedures, and reporting.
• Produce metrics and key performance indicators demonstrating the effectiveness of enterprise remediation efforts.
• Improve the design and usefulness of IT security management tools and solutions.
• Work with cross-department security engineering and incident response teams on enterprise security initiatives.
• Apply sound judgment when making technical decisions and navigate difficult situations with resilience, composure, and tact.

Requirements

• 5+ years of experience in IT operations, systems management, or IT security.
• Hands-on expertise with enterprise network architectures, Linux and Windows operating systems, system administration, or software development.
• Knowledge of IT security and system-hardening best practices across operating systems, public cloud, web applications, network devices, and SDLC processes.
• Understanding of enterprise networking concepts, architectures, protocols, segmentation, and access controls to improve vulnerability scanning strategy and coverage.
• Knowledge of Active Directory best practices and security hardening.
• Experience analyzing vulnerability findings from IT and security management tools.
• Understanding of industry standards and concepts including NIST, CVE, CPE, and CVSS.
• Ability to interpret complex data sets and make informed, risk-based decisions.
• Ability to manage complex tasks, projects, and initiatives effectively.
• Solid understanding of risk-management frameworks.
• Experience with operational vulnerability scanners and attack-surface or path-management tools such as Rapid7, Qualys, Nessus, and BloodHound.
• Ability to learn and implement technologies quickly.
• Bachelor's degree in Computer Science, Engineering, Information Security, or a related field.
• 2+ years of Python programming experience.
• Excellent interpersonal and communication skills.

Benefits

Benefits and total rewards may include merit increases, incentive compensation for exempt roles, paid holidays, paid time off, medical, dental, vision, short- and long-term disability benefits, 401(k) matching, life insurance, and wellness programs.