Senior Business Analyst - Information Security

About the role

EY's Information Security team protects the firm's brand through technical security controls, a defined security strategy and ongoing compliance and incident management programs. The Senior Security Business Analyst works in the Enterprise Security Program and the Information Security Service Delivery team, partnering with project stakeholders and security services to capture, document, communicate and manage business and security requirements, propose solutions and drive business process improvement.

Key responsibilities

• Elicit, analyze, document and manage business and security requirements for complex projects in the Enterprise Security Program
• Work with business, security, technical and project management stakeholders so requirements are clear, feasible and aligned with organizational objectives
• Partner with Security Quality Assurance staff to validate and test security solutions against documented requirements
• Trace requirements to code, policies, confirmations and other implementation artifacts, and to the test cases that validate them
• Contribute to continuous improvement of security business analysis processes and tools, and share knowledge and best practices with peers

Required profile

• Fluent English, able to adapt communication to executives, sponsors, management, the organization and project teams (verbal, written and presentation)
• Ability to resolve delivery challenges and escalations, and to collaborate across functions, cultures and geographies, building trust virtually
• Customer focus and personal accountability for business analyst deliverables
• Preferably 8-10 years of business analysis experience in information security for large, geographically diverse programs
• Strong expertise in security technologies (cloud, network, perimeter, messaging, endpoint and data security)
• Relevant certifications such as CISSP, CISM or CBAP are highly desirable

Required skills

• Requirements elicitation: interviews, exploratory prototypes, facilitated workshops, focus groups, observation, task analysis, documentation study, surveys and process re-engineering
• Requirements models: stakeholder categories, actor tables, glossary, context diagram, data model, class model, data dictionary, event response tables, state diagrams, business rules, decision tables, process maps, use cases and activity diagrams
• Requirements management methodologies and tools
• Leadership in IT methodologies, processes and standards for business analysis