Information Security Analyst Job Requirements

An Information Security Analyst is responsible for protecting an organization's information assets in whatever shape, form or medium it is handled by employing set of strategies, methodologies, technologies and processes to manage threats capable of impacting the confidentiality, integrity and availability such information assets. Unlike cyber security analyst who provides risk assurance on IT infrastructures and systems within an organization's network that interact with the cyberspace (i.e. internet), an information security analyst is responsible for the security an organization's information assets, which include business data, business/trade secrets, documents, files, customer information, IT infrastructures/systems, regulatory/legal information, brand information, etc. that are capable of embarrassing or inflict harm to an organization in the event that such information or data are compromised, leaked or stolen with its attendant reputational, legal or financial impact. In other words, cyber security function is a subset of information security although many organizations see both functions as the same depending on the scope of their practice. The role of an information security analyst is all encompass as requires employing programs, methodologies and processes for managing an organization's information security risk. An information security analyst ensures the establishment of an enterprise information security policy and other supporting policies within the organization. He/she ensures management commitment to information security through his reporting lines (CISO) and ensure that the information security policy and management commitment is communicated across the enterprise. An information security analyst ensures adoption of good security practices, compliance with information security policies/procedures and awareness of information security tenets within an organization. He/she ensures a uniform culture (principles) of information security among employees, vendors and other third parties that have business deals with the organization.

By certifying to ISO 27001:2013 information security management system (ISMS), an information security analyst can use the management system framework to improve information security across the organization. An information security analyst ensures classification of information in a manner that protects such information from unauthorized access or disclosure and ensures access on the need-to-know basis. Classification types such as confidential, secret, public or internal restricted, internal general, external and public can be used to categorize information in terms of their audience and need for such information. Just like cyber security analyst, information security analysts is also responsible for implementing security measures in IT infrastructure (e.g. network, operation systems, databases, applications, etc) to protect an organization information assets from the risks that could impact the confidentiality, integrity and availability such infrastructures. Information security analysts are expected to be abreast with changes within the organization's information assets, regulatory and industry changes, technological advances and dynamic threat landscape in the cyberspace. This is to enable him/her anticipate possible security breaches, data losses/leaks and activities that could cause denies services to consumers. He/her should ensure compliance with the internal and regulatory policies as well as applicable laws as regards information security by put in place relevant controls and monitoring frameworks to enforce compliance.

Reporting line of an Information Security Analyst

Information security analyst reports to the Chief Information Security Officer (CISO) who is a member of the senior management team and accountable to the Board of Directors.

Professional Certifications for Information Security Analyst

To be endorsed as an information security analyst, practitioners must acquire the prestigious Certified Information Systems Security Professional (CISSP) by ISC2, Certified Information Security Manager (CISM) by ISACA, ISO/IEC 27001 (ISMS) certification, ISO/IEC 22301 (BCMS) cerification, among others.