Senior Associate, IT Security

Position Summary

The Senior Associate, IT Security is a hands-on security operations practitioner embedded within Fortitude Group Services' Security Operations function. This role is responsible for day-to-day monitoring, investigation, and response to security events across the enterprise, with primary focus on security operations center (SOC) activities, vulnerability management operations, phishing and email security analysis, and audit evidence support.

The Senior Associate owns the operational execution of recurring security workflows, serves as a technical contributor during incident response, and partners with the Managed Security Service Provider (MSSP) on alert triage and escalation quality. The role is a trusted operational resource across the Security team and reports to the AVP Security Architect, with success defined by consistent operational delivery, measurable improvement in alert handling and vulnerability remediation workflows, and quality of audit and regulatory evidence produced from day-to-day work.

What You Will Do:

Security Operations – Monitoring, Alert Triage & Incident Response

• Participate in Security Operations Center (SOC) activities including alert triage, event investigation, and escalation in coordination with the MSSP
• Serve as a technical contributor during security incidents across endpoint, cloud, identity, and email domains; assist with containment, evidence collection, timeline construction, and documentation under the direction of security leadership
• Analyze logs, telemetry, and security tool outputs from EDR, SIEM, CNAPP, email security, and web security platforms to identify threats and anomalies
• Monitor queue health, service levels, and escalation quality from the MSSP; flag gaps and recommend tuning or process improvements
• Maintain operational playbooks and runbooks for recurring incident types; keep documentation current as tooling and processes evolve
• Produce after-action notes and operational metrics from incident handling to support continuous improvement and executive reporting

Vulnerability & Attack Surface Management

• Own the day-to-day operation of the vulnerability management workflow including scan review, finding triage, remediation tracking, SLA reporting, and risk acceptance coordination
• Prioritize exposures based on exploitability (CVSS, EPSS), CISA Known Exploited Vulnerabilities (KEV), business impact, and regulatory significance
• Coordinate directly with infrastructure, cloud, and application teams on remediation workflows; drive accountability for closure within SLA
• Produce recurring vulnerability metrics and reporting for internal stakeholders and leadership
• Support attack surface reviews and periodic cleanup efforts for stale assets, excessive permissions, and exposed credentials identified through security tooling

Phishing & Email Security

• Investigate reported phishing emails and coordinate response actions including quarantine, block list updates, and user notification
• Analyze email security platform telemetry to identify campaign patterns, emerging threats, and gaps in filtering controls
• Support phishing simulation program execution and contribute to security awareness reporting and user education feedback
• Partner with the MSSP and email security vendor on operational tuning, false positive reduction, and investigation support

Audit, Compliance & Evidence Support

• Retrieve, organize, and contextualize security data from applicable platforms to support audit and regulatory evidence requests
• Maintain operational documentation of recurring security workflows, control execution, and incident records to support audit readiness
• Support control testing activities by producing evidence packages aligned to NYDFS 23 NYCRR 500, NIST CSF, and other applicable frameworks
• Coordinate with internal audit and compliance partners during examination cycles and recurring control reviews

Security Projects & Cross-Functional Support

• Contribute to security operations projects as assigned, including tool deployments, control enhancements, process improvements, and operational automation
• Assist the AVP Security Architect with technical tasks, documentation, and operational execution across the security program
• Partner with infrastructure, cloud, IT, and business units to deliver operational security outcomes without disrupting business objectives
• Mentor junior staff or interns as the team grows; share institutional knowledge through documentation and knowledge transfer sessions
• undefined

 

What You Will Have:

Required Experience & Skills

•   5+ years of experience in a cybersecurity analyst, security operations, or information security role
• Hands-on experience with security monitoring, incident investigation, and response workflows in an enterprise environment
• Working knowledge of common security platforms and tooling categories including SIEM, EDR, email security, and vulnerability management
• Experience operating vulnerability management workflows end to end including scan review, finding prioritization, remediation coordination, and SLA tracking
• Experience investigating phishing campaigns and operating email security platforms
• Ability to investigate security events across multiple data sources, synthesize findings, and communicate clearly to technical and non-technical stakeholders
• Strong written and verbal communication skills; ability to produce audit-quality documentation and incident records
• Familiarity with regulatory and compliance frameworks applicable to financial services including NYDFS, NIST CSF, SOC 2, or equivalent
• A risk-oriented mindset with the judgment to prioritize and escalate appropriately
• Ability to work independently on recurring operational workflows and as part of a team during active incident response

Preferred Experience & Domain Familiarity:

• Experience working within or alongside a Managed Security Service Provider (MSSP) or co-managed SOC model
• Familiarity with Cloud-Native Application Protection Platforms (CNAPP) for cloud asset visibility, vulnerability findings, and runtime security monitoring
• Experience with Endpoint Detection and Response (EDR) platforms for threat detection, forensic triage, and prevention policy management
• Exposure to cloud security operations in AWS or Azure environments including cloud logging and security posture management
• Experience with enterprise email security platforms and anti-phishing controls
• Familiarity with web security and proxy tooling for outbound traffic monitoring and DLP enforcement
• Prior experience in a regulated industry, preferably financial services, insurance, or reinsurance

Certifications (Nice to Have)

• CompTIA Security+ (Sec+)
• CompTIA CySA+ or equivalent analyst-level certification
• GIAC Security Essentials (GSEC) or other GIAC certifications
• Microsoft SC-series certifications (e.g., SC-200 Security Operations Analyst)
• AWS Security Specialty or equivalent cloud security certification
• CEH, eJPT, or other hands-on security practitioner credentials