What Is Information Security Analyst?

The information security analyst is the person who's always telling you to take the stairs instead of the elevator. They're the ones who memorize all your passwords, so you don't have to. They keep their eyes on your back while you're looking out front—or at least they try. What do they do? An information security analyst is an individual that reviews and analyzes IT environments/infrastructures for information security design, implementation and maintenance-related processes. They look at existing systems and procedures, identify weaknesses, recommend how to fix them and help implement those changes. They also help establish policies and standards for protecting sensitive data from unauthorized access or modification. They're responsible for creating policies that ensure compliance with regulations such as HIPAA (Health Insurance Portability and Accountability Act), Sarbanes-Oxley Act and Gramm-Leach-Bliley Act, PCI DSS (Payment Card Industry Data Security Standard) and others. Information security analysts are always looking for new ways to improve the security of your environment. They feel satisfied when they find something that's not as secure as possible and help you fix it. Information security analysts are like your own detectives: they investigate things that could go wrong with your system and then figure out how to prevent them. Information security analysts don't just work at the office—they work at home on their computers, too! They're looking for ways to improve their skills to do their job better than anyone else in the industry. Information security is a vast and complex field, but one thing is clear: you will need an analyst to protect your business. Information security analysts review a business's information security requirements, threats and vulnerabilities and recommend security measures to provide the best protection. For example, for an e-commerce platform, an information security analyst may recommend having a web application/website firewall to protect back-end servers from penetration and intruder attacks.