- Company Name
- Base 3
- Job Title
- Security Risk Assessment Analyst
- Job Description
-
<think>
Okay, let's tackle this job description to create the mini-profile as requested. First, I need to parse the user's query carefully. The goal is to normalize the job description into a concise profile for job matching. The user specified certain sections to include: Job Title, Role Summary, Expectations, Key Responsibilities, Required Skills, and Required Education & Certifications. Also, I need to exclude company details, location, benefits, or fluff. Keep it under 500 words, factual, concise, ATS-friendly, and globally neutral.
Starting with the job title. The original is "Security Risk Assessment Analyst", which seems accurate. The note mentions candidates should be based in certain countries, but those are location details, which we need to exclude. The client's note about UK-based candidates using an accredited umbrella company is also location info, so skip.
Role Summary: The job is for a Senior Security Analyst to contribute to designing and enhancing application security risk assessments. Work with cross-functional teams on various topics and technologies. Need to summarize that concisely.
Expectations: The original mentions 8 days per month at the client's office. However, the user said to exclude location details. Wait, maybe the mandatory office days count as fluff? Or is it part of expectations? Hmm, the user specified to exclude location. So the 8 days/month might still be required, but since it's location-based, maybe it's part of the note to exclude. The note says "8 days a month at a clients office is mandatory" – that's a key expectation but tied to location. Since location is to be excluded, maybe omit that part. Wait, but maybe "Expectations" in the structure includes work requirements not related to location. Let me check the original job description again. The note about 8 days/month is a requirement, but the user wants to exclude location. So perhaps the 8 days/month is part of the job requirements but also a location detail, so it should be excluded. Or is it a work arrangement that's not location? It's a bit ambiguous. Since the user wants to exclude location details, maybe I should leave it out. But the user also said "Exclude fluff". The note starts with location requirements, but also includes the 8 days/month. Since the 8 days is a work schedule, but it's tied to being at a client's office (location), maybe it's better to exclude it to avoid any location details. However, maybe the "Expectations" section can mention the mandatory on-site work without specifying the location. Let me think. The user says to exclude company details, location, benefits, or fluff. So "8 days a month at a client's office is mandatory" is a work schedule, but the location is part of the exclusion. The phrase itself is a work expectation, but since it's tied to location (client's office), perhaps it's better to exclude it here. Maybe the structure allows for mentioning the requirement of on-site work without mentioning the location. The user might be okay with mentioning the expectation of on-site days, as it's not a specific location. For example, "Mandatory on-site work at client offices (8 days/month)" would be acceptable. That's a bit of a judgment call. Given that the user wants to exclude location details, maybe I should rephrase it to not mention location. Alternatively, maybe the user wants all location-specific info removed, in which case the 8 days/month is work-related, but since it's tied to location (client's office), perhaps it's better to exclude entirely.
Next, Required Experience: The job requires 5-10 years of experience in security risk assessments, designing security processes, frameworks, solutions. Also, understanding of cybersecurity frameworks (ISO 27001, CIS, NIST, DORA), threat/risk frameworks (MITRE, EBIOS), financial IT regulations (DORA, ESMA). Practical knowledge of info security controls, experience with Microsoft Azure, IBM Mainframe, Windows platforms. Fluency in English. Previous experience in financial sector. Knowledge of financial markets, FMIs, CSD operations as an advantage. Experience with tools like ServiceNow, Excel, basic security testing platforms. ServiceNow GRC experience is a plus. Certifications like CISSP, CSSLP, etc., are advantageous.
Key Responsibilities: Performing security risk assessments across applications, collaborating with cross-functional teams, enhancing security risk assessment processes.
Required Education: Not explicitly mentioned, but the required experience is 5-10 years. The education part isn't specified, so maybe leave it as "Not specified" or omit. Wait, the user asked for "Required Education & Certifications". The original doesn't mention education, so education would be omitted. Certifications are listed as part of the requirements (CISSP, CSSLP, etc.), which are to be listed under certifications.
Skills: The user wants "Required Skills" and "Required Education & Certifications". The original mentions fluency in English, and the need for previous experience in the financial sector. Also, knowledge of financial markets, etc., is an advantage. But the required skills would include technical skills like understanding cybersecurity frameworks, threat modeling, using tools, etc.
Putting it all together:
Job Title: Security Risk Assessment Analyst
Role Summary: Senior-level role in designing and improving application security risk assessments. Collaborate with cross-functional teams on diverse technologies and business topics.
Expectations: Must have 5-10 years in security risk assessments, designing security processes/solutions. Experience with cybersecurity frameworks (ISO 27001, CIS, NIST, DORA), threat/risk frameworks (MITRE, EBIOS), financial IT regulations (DORA, ESMA). Practical knowledge of information security controls. Hands-on experience with Microsoft Azure, IBM Mainframe, Windows platforms. Fluency in English. Previous financial sector experience required. Knowledge of financial markets, FMIs, CSD operations preferred.
Key Responsibilities: Conduct security risk assessments across applications. Collaborate with multi-functional teams to enhance security risk assessment processes.
Required Skills: Cybersecurity frameworks (ISO 27001, CIS, NIST, DORA), threat/risk frameworks (MITRE, EBIOS). Financial IT regulations (DORA, ESMA). Application security, Microsoft Azure, IBM Mainframe, Windows security. Financial market operations. Collaboration across teams. Analytical/problem-solving, communication, stakeholder engagement.
Required Education & Certifications: Certifications such as CISSP, CSSLP, CCSP, CISM, CISMP, GCIH, CEH preferred.
Wait, but the education is not specified. The user might want to list certifications under "Certifications" which are preferred here. Also, the original mentions that previous experience in the financial sector is required, but not formal education. So in the Required Education section, it's not provided, but perhaps certifications are part of that section.
I need to structure it as per the user's required sections. Let me check the user's example structure again to ensure alignment.
User wants:
Job title,
Role Summary,
Expectations,
Key Responsibilities,
Required Skills,
Required Education & Certifications.
Now, putting all the info into these sections without the excluded elements. Make sure to use keywords for ATS, concise, and globally neutral. Avoid any markdown, just plain text. Also, no extra explanations, just the sections.
Let me revise each section:
Role Summary: Senior Security Analyst responsible for designing and enhancing application security risk assessment processes. Perform assessments across diverse applications and collaborate with cross-functional teams on various business and technical topics.
Expectations: 5-10 years in security risk assessments, designing security processes or solutions. Proficiency in cybersecurity frameworks (ISO 27001, CIS, NIST, DORA) and threat/risk frameworks (MITRE, EBIOS). Understanding of financial IT regulations (DORA, ESMA). Experience with info security controls. Hands-on with Azure, IBM Mainframe, Windows. Financial sector experience required. Financial markets, FMIs, CSD operations knowledge preferred. English fluency mandatory.
Key Responsibilities: Conduct security risk assessments across applications. Enhance application security risk assessment processes. Collaborate with cross-functional teams on technical and business aspects. Apply security requirements and controls.
Required Skills: Cybersecurity frameworks (ISO 27001, CIS, NIST, DORA). Threat/risk frameworks (MITRE, EBIOS). Financial IT regulations (DORA, ESMA). Application security design. Microsoft Azure, IBM Mainframe, Windows platforms. Financial market operations. Collaborative stakeholder engagement. Strong analytical and problem-solving skills. Communication with technical and non-technical teams.
Required Education & Certifications: None specified. Certifications preferred (CISSP, CSSLP, CCSP, CISM, CISMP, GCIH, CEH).
Wait, the original job description mentions certifications as "advantage", so in the Required Education & Certifications, it's "Certifications such as CISSP, etc. preferred." So maybe list them as "Certifications: CISSP, CSSLP, CCSP, CISM, CISMP, GCIH, CEH (advantageous)."" But the user wants Required Education & Certifications. Since the certifications are advantageous but not required, maybe list as "Preferred certifications: CISSP, etc. No formal education required."
But the user might prefer to have the required education and required certifications listed. Since the original says certifications are an advantage, they are not required. So perhaps in "Required Education & Certifications", it's "None required. Preferred certifications:..." But the user's instruction says to include both required education and certifications. If the education isn't mentioned, leave it blank and list the certifications as preferred.
Alternatively, the user might want to include certifications under "Required Education & Certifications", even if they are preferred. Since the original says