Threat Evaluation Analyst - Cyber Security Operations
Denver, Colorado;Washington, District of Columbia
**Job Description:**
Are you passionate about working with the best information security team in the world? Bank of America is hiring top talent to join our team.
The Cyber Security Operations (CSO) function within Global Information Security is responsible for all aspects of threat intelligence and monitoring, application and network security, and insider threat. In addition, the CSO team drives out the enterprise-wide cyber exercise program.
The Threat Evaluation Analyst synthesizes threat intelligence and technical knowledge of/expertise in bank processes and controls from multiple sources (to include process & control owners, assessments, tests, dashboards, the SPI) in order to appropriately characterize the banks processes & controls in light of a specific threat and identify/document associated opportunities for enhancement. This role will directly assist in the identification, design and delivery of improvements to defense capabilities based on threat intelligence, risk processes, threat evaluations and incidents / issues throughout the Bank. The role exists within an environment that is extremely fast-paced and requires superior organizational and time-management skills but is also open, collaborative and possesses a global presence. **_Job duties responsibilities include:_**
+ Applying technical expertise/experience in reviewing Threat Intake submissions to ensure full comprehension and obtain the clarification and/or additional information required for the proper and timely execution of the threat evaluation function
+ Working with Cyber Threat Defense Operations teammates, GIS control owners, subject matter experts and other partners to understand the bank's current defensive posture against specific threats and identify opportunities for improvement
+ Reviewing existing process and control information as it relates to the threat from cyber assessments
+ Producing written documentation (e.g. a completed Threat Evaluation form) of in-scope controls for a given threat. This includes summarizing control evaluation takeaways as it relates to the threat for consumption by other GIS partners
+ Presenting findings to senior leaders and peers across and external to GIS on the threat scenario; as required, representing the Threat Evaluation function as proxy for team lead
+ Ensuring the Threat Evaluation function maintains an accurate, up-to-date and accessible report on the status of its work while meeting all OLAs/timelines
+ Ensuring the Threat Evaluation function effectively captures and warehouses all relevant control information for re-use and application in broader GIS/CSD efforts
+ Assisting with the development/maturation of the Threat Evaluation function, to include the establishment/development of relationships with key partners and the development of technology solutions
+ Demonstrating exceptional organizational and cross-functional communication skills to integrate information/data/analysis from across the Enterprise
Required Skills:
+ Direct experience with cybersecurity/GIS processes and controls, particularly technical/CSD processes and controls, is strongly desired (e.g., (Process or Control Owner; significant Technical Control team expertise)
+ Direct experience with or strong familiarity with cybersecurity assessments and testing is highly desired
+ Working knowledge of the MITRE ATT&CK Framework is highly desired
+ Single Process Inventory (SPI & Process Owner Portal) Framework is desired
+ Information security frameworks such as NIST CSF (cybersecurity framework), FFIEC CAT is desired
+ Risk Analysis, risk models, risk quantification, risk score development is desired
The application of existing and developed technical knowledge of and experience with information security controls, infrastructure, problem management, risk identification and remediation is key to this role. The role requires significant data analysis and communication skills and superior organizational abilities (documentation, attention to detail) together with a passion for working in a dynamic, fast-paced environment. This is a developing function within the Cyber Security Operations unit and as such offers an outstanding opportunity for the right candidate to demonstrate and greatly develop their skills.
**Job Band:**
H5
**Shift:**
1st shift (United States of America)
**Hours Per Week:**
40
**Weekly Schedule:**
**Referral Bonus Amount:**
0
**Job Description:**
Are you passionate about working with the best information security team in the world? Bank of America is hiring top talent to join our team.
The Cyber Security Operations (CSO) function within Global Information Security is responsible for all aspects of threat intelligence and monitoring, application and network security, and insider threat. In addition, the CSO team drives out the enterprise-wide cyber exercise program.
The Threat Evaluation Analyst synthesizes threat intelligence and technical knowledge of/expertise in bank processes and controls from multiple sources (to include process & control owners, assessments, tests, dashboards, the SPI) in order to appropriately characterize the banks processes & controls in light of a specific threat and identify/document associated opportunities for enhancement. This role will directly assist in the identification, design and delivery of improvements to defense capabilities based on threat intelligence, risk processes, threat evaluations and incidents / issues throughout the Bank. The role exists within an environment that is extremely fast-paced and requires superior organizational and time-management skills but is also open, collaborative and possesses a global presence. **_Job duties responsibilities include:_**
+ Applying technical expertise/experience in reviewing Threat Intake submissions to ensure full comprehension and obtain the clarification and/or additional information required for the proper and timely execution of the threat evaluation function
+ Working with Cyber Threat Defense Operations teammates, GIS control owners, subject matter experts and other partners to understand the bank's current defensive posture against specific threats and identify opportunities for improvement
+ Reviewing existing process and control information as it relates to the threat from cyber assessments
+ Producing written documentation (e.g. a completed Threat Evaluation form) of in-scope controls for a given threat. This includes summarizing control evaluation takeaways as it relates to the threat for consumption by other GIS partners
+ Presenting findings to senior leaders and peers across and external to GIS on the threat scenario; as required, representing the Threat Evaluation function as proxy for team lead
+ Ensuring the Threat Evaluation function maintains an accurate, up-to-date and accessible report on the status of its work while meeting all OLAs/timelines
+ Ensuring the Threat Evaluation function effectively captures and warehouses all relevant control information for re-use and application in broader GIS/CSD efforts
+ Assisting with the development/maturation of the Threat Evaluation function, to include the establishment/development of relationships with key partners and the development of technology solutions
+ Demonstrating exceptional organizational and cross-functional communication skills to integrate information/data/analysis from across the Enterprise
Required Skills:
+ Direct experience with cybersecurity/GIS processes and controls, particularly technical/CSD processes and controls, is strongly desired (e.g., (Process or Control Owner; significant Technical Control team expertise)
+ Direct experience with or strong familiarity with cybersecurity assessments and testing is highly desired
+ Working knowledge of the MITRE ATT&CK Framework is highly desired
+ Single Process Inventory (SPI & Process Owner Portal) Framework is desired
+ Information security frameworks such as NIST CSF (cybersecurity framework), FFIEC CAT is desired
+ Risk Analysis, risk models, risk quantification, risk score development is desired
The application of existing and developed technical knowledge of and experience with information security controls, infrastructure, problem management, risk identification and remediation is key to this role. The role requires significant data analysis and communication skills and superior organizational abilities (documentation, attention to detail) together with a passion for working in a dynamic, fast-paced environment. This is a developing function within the Cyber Security Operations unit and as such offers an outstanding opportunity for the right candidate to demonstrate and greatly develop their skills.
**Shift:**
1st shift (United States of America)
**Hours Per Week:**
40
Learn more about this role
Full time
JR-22066510
Band: H5
Manages People: No
Travel: No
Manager:
Talent Acquisition Contact:
Adam Waller
Referral Bonus:
0
Colorado pay and benefits information
**Colorado pay range:**
$86,500 - $135,000
annualized salary, offers to be determined based on experience, education and skill set.
**Discretionary incentive eligible**
This role is eligible to participate in the annual discretionary plan. Employees are eligible for an annual discretionary award based on their overall individual performance results and behaviors, the performance and contributions of their line of business and/or group; and the overall success of the Company.
**Benefits**
This role is currently benefits eligible . We provide industry-leading benefits, resources and support to our employees so they can make a genuine impact and contribute to the sustainable growth of our business and the communities we serve.
Bank of America and its affiliates consider for employment and hire qualified candidates without regard to race, religious creed, religion, color, sex, sexual orientation, genetic information, gender, gender identity, gender expression, age, national origin, ancestry, citizenship, protected veteran or disability status or any factor prohibited by law, and as such affirms in policy and practice to support and promote the concept of equal employment opportunity and affirmative action, in accordance with all applicable federal, state, provincial and municipal laws. The company also prohibits discrimination on other bases such as medical condition, marital status or any other factor that is irrelevant to the performance of our teammates.
To view the "EEO is the Law" poster, CLICK HERE (https://www.dol.gov/ofccp/regs/compliance/posters/pdf/eeopost.pdf) .
To view the "EEO is the Law" Supplement, CLICK HERE (https://www.dol.gov/ofccp/regs/compliance/posters/pdf/OFCCP\_EEO\_Supplement\_Final\_JRF\_QA\_508c.pdf) .
Bank of America aims to create a workplace free from the dangers and resulting consequences of illegal and illicit drug use and alcohol abuse. Our Drug-Free Workplace and Alcohol Policy (Policy) establishes requirements to prevent the presence or use of illegal or illicit drugs or unauthorized alcohol on Bank of America premises and to provide a safe work environment.
To view Bank of Americas Drug-free workplace and alcohol policy, CLICK HERE .
