Job description

Planned Parenthood is the nation’s leading provider and advocate of high-quality, affordable sexual and reproductive health care for all people, as well as the nation’s largest provider of sex education. With more than 600 health centers across the country, Planned Parenthood organizations serve all patients with care and compassion, with respect, and without judgment, striving to create equitable access to health care. Through health centers, programs in schools and communities, and online resources, Planned Parenthood is a trusted source of reliable education and information that allows people to make informed health decisions. We do all this because we care passionately about helping people lead healthier lives. Planned Parenthood Federation of America (PPFA) is a 501(c)(3) charitable organization that supports the independently incorporated Planned Parenthood affiliates operating health centers across the U.S. Planned Parenthood Action Fund is an independent, nonpartisan, not-for-profit membership organization formed as the advocacy and political arm of Planned Parenthood Federation of America. The Action Fund engages in educational, advocacy, and electoral activity, including grassroots organizing, legislative advocacy, and voter education. Planned Parenthood Federation of America (PPFA) and Planned Parenthood Action Fund (PPAF) seek a dynamic and effective Senior Information Security Analyst . This job reports to the Director, Incident Response Threat & Vulnerability Management in the Information Security Program of PPFA. The PPFA Information Security provides the strategy and implementation of the information security program that safeguards the data entrusted to Planned Parenthood by its patients, supporters, donors and staff. Purpose: This role is responsible for supporting the Director of IR & Threat Vulnerability in building and maintaining the enterprise-wide Vulnerability, Incident Response and Cyber Threat Management programs. The Senior Information Security Analyst performs all phases of the incident response life cycle: preparation, analysis, containment, eradication, remediation, recovery and post-incident activity for all incidents in support of the National Office and the Federation. Completes threat hunting in both on-premise and cloud environments. Responsible for identifying, triaging, filtering, and documenting vulnerabilities and threats across the enterprise and working with business unit partners to harmoniously resolve security matters. The Senior Information Security Analyst will help manage the MSSP partner for alert monitoring and will be tasked with responding, if necessary, to events/incidents on a 24x7 basis. The person will also be responsible for monitoring, building, augmenting, and integrating threat detection and remediation capabilities into security operations to address emergent cyber threats to PPFA products, services, data, and infrastructure. The Senior Information Security Analyst is expected to have a thorough understanding of complex systems and stay up-to-date with the latest security standards, products, and knowledge of the evolving threat landscape. Delivery: Respond to security incidents and investigations, acting as technical lead for all phases of Incident Response. Analyzes existing Incident Response (IR) processes and provides actionable technical recommendations to the immediate IR team.. Maintains and updates procedures, guidelines, and playbooks to streamline security incidents under the guidance of IR leadership Maintain thorough documentation of cyber threats, threat vectors, threat actors, and threat trends for threat modeling activities and security incidents. Assist in developing policies, procedures, and playbooks for cybersecurity, intelligence, and data protection. Mature and continuously benchmark the PPFA incident response playbook, liaising with vendor partners, Affiliate IT Leadership, and closely partnering with PPFA business functions. Monitors robust alerting and reporting mechanisms performed by MSSP as well as internal capabilities to potential cyber threats. Collects, analyzes, and maintains metrics and threat intelligence briefs that illustrate the impact of the current threat landscape. Coordinates with external forensics retainer to ensure confidential and in-depth investigations promptly, disseminating and maintaining reports on a highly confidential basis. Maintain current understanding of malicious adversaries, threat groups, and campaigns, indicators of compromise (IOCs), and highly granular tools. Develop work plans for IR and Threat Intelligence, as delegated by the Director, IR & Vulnerability Threat Management and complete initiatives within and across teams to ensure timely delivery. Engagement: Support the InfoSec Operations team with vulnerability scans, penetration tests, and logging and event management results that may indicate pre-incident indicators, ineffective processes, procedures, and standards. Work with the team on recommendations and findings, both in written reports and in presentation format, to the Information Security Team and business unit partners Collaborate with key stakeholders at the National Office and the Affiliates on key findings and root cause analysis improvements. Support executive leader communications on potential emergent threats and ongoing efforts to resolve active cybersecurity incidents and investigations. Partner with stakeholders to enhance incident readiness through exercises and drills, and optimize IR and Threat Intelligence capabilities Collaborate with strategic vendor partners and external security research communities and cultivate durable relationships with external agencies and companies to produce a pipeline of high-quality threat intelligence. Work across department lines in developing product vulnerability remediation and incident response. Partners with architectural teams to conduct proof-of-concept evaluations for emerging technologies for security stack and production environment. Knowledge, Skills and Abilities (KSAs): Reporting to the Director, InfoSec Operations IR & Threat Intelligence, these are the skills and abilities that mark a strong candidate as part of our InfoSec Operations team. Bachelor's degree in Information Technology, Cybersecurity or equivalent experience Information Security certifications preferred 5+ years of work experience in Cybersecurity, threat detection, incident response, and vulnerability management in an Information Security Operations capacity or in a related field Industry certifications such as CISSP, GCIH, or CySA are highly preferred Experience coordinating security incident meetings, dividing responsibilities, and influencing key stakeholders to resolve security incidents. Experience and strong understanding of multiple forms of Indicators of Compromise (IoCs) and corresponding capabilities to detect, alert on them, and share information across key stakeholders. Experience with Security frameworks such as NIST CSF and MITRE ATT&CK. Experience with Annual Threat Assessment and Control Gap Analysis. Experience with building and reporting on Key Performance Indicators (KPI), Key Risk Indicators (KRI) and establishing thresholds with corrective actions. Knowledge of the external security community’s culture and mindset. Ability to recognize and respond to problems with potential solutions in a highly professional, confidential and sensitive manner. Familiarity with Cloud and Hybrid architectures. Strong interpersonal skills. Excellent analytical skills with sharp attention to detail and the ability to meet critical deadlines. Self-directed and can work alone or in a team. Ability to work collaboratively and flexibly with a dynamic, fast-moving team, completing multiple tasks with poise, accuracy, and confidence. Strong organizational, analytical, and problem-solving skills Strong oral and written communication skills. Experience in managing or leveraging a variety of security appliances, such as SIEM, EDR, Email gateways, etc. Flexibility and ability to adapt to quickly changing priorities and ambiguous situations A deep commitment to Planned Parenthood’s mission of promoting Sexual and Reproductive Health. On-Call Rotation: Participate in a 24/7 on-call rotation to monitor, detect, and respond to urgent security alerts and potential cyber incidents. Travel: 0-10% travel, as needed. Parenthood Federation of America is an equal employment opportunity employer and is committed to maintaining a non-discriminatory work environment, and does not discriminate against any employee or applicant for employment on the basis of race, color, religion, sex, national origin, age, disability, veteran status, marital status, sexual orientation, gender identity, or any other characteristic protected by applicable law. Planned Parenthood is committed to creating a dynamic work environment that values diversity and inclusion, respect and integrity, customer focus, and innovation.

Requirements

Must-haves

Respond to security incidents and investigations, acting as technical lead for all phases of Incident Response.
Analyzes existing Incident Response (IR) processes and provides actionable technical recommendations to the immediate IR team..
Maintains and updates procedures, guidelines, and playbooks to streamline security incidents under the guidance of IR leadership
Maintain thorough documentation of cyber threats, threat vectors, threat actors, and threat trends for threat modeling activities and security incidents.
Assist in developing policies, procedures, and playbooks for cybersecurity, intelligence, and data protection.
Mature and continuously benchmark the PPFA incident response playbook, liaising with vendor partners, Affiliate IT Leadership, and closely partnering with PPFA business functions.
Monitors robust alerting and reporting mechanisms performed by MSSP as well as internal capabilities to potential cyber threats.
Collects, analyzes, and maintains metrics and threat intelligence briefs that illustrate the impact of the current threat landscape.
Coordinates with external forensics retainer to ensure confidential and in-depth investigations promptly, disseminating and maintaining reports on a highly confidential basis.
Maintain current understanding of malicious adversaries, threat groups, and campaigns, indicators of compromise (IOCs), and highly granular tools.
Develop work plans for IR and Threat Intelligence, as delegated by the Director, IR & Vulnerability Threat Management and complete initiatives within and across teams to ensure timely delivery.
Support the InfoSec Operations team with vulnerability scans, penetration tests, and logging and event management results that may indicate pre-incident indicators, ineffective processes, procedures, and standards.
Work with the team on recommendations and findings, both in written reports and in presentation format, to the Information Security Team and business unit partners
Collaborate with key stakeholders at the National Office and the Affiliates on key findings and root cause analysis improvements.
Support executive leader communications on potential emergent threats and ongoing efforts to resolve active cybersecurity incidents and investigations.
Partner with stakeholders to enhance incident readiness through exercises and drills, and optimize IR and Threat Intelligence capabilities
Collaborate with strategic vendor partners and external security research communities and cultivate durable relationships with external agencies and companies to produce a pipeline of high-quality threat intelligence.
Work across department lines in developing product vulnerability remediation and incident response.
Partners with architectural teams to conduct proof-of-concept evaluations for emerging technologies for security stack and production environment.
Reporting to the Director, InfoSec Operations IR & Threat Intelligence, these are the skills and abilities that mark a strong candidate as part of our InfoSec Operations team.
Bachelor's degree in Information Technology, Cybersecurity or equivalent experience
5+ years of work experience in Cybersecurity, threat detection, incident response, and vulnerability management in an Information Security Operations capacity or in a related field

Nice-to-haves

Information Security certifications preferred
Industry certifications such as CISSP, GCIH, or CySA are highly preferred

Application prep

Use the role’s language and application details while tailoring your materials.

Platform: lever
Effort: quick