INFORMATION SECURITY ANALYST

At Nox Group, we are dedicated to humanizing construction as one of the fastest-growing industrial enterprises in the US. Nox Group owns and operates Corbins, RMCI, Nox Innovations, and Construction Labels, and our teams set the standard as industry leaders. As we continue to expand our reach nationwide, we seek people who are passionate about personal growth and eager to make a positive impact throughout the industries and communities we serve. We prioritize our people, our partners, and our relationships. Start your journey today and join our skilled team.

The Information Security Analyst is a technical position within the IT department.

The primary function of this position is to operate and maintain Nox Group’s information security program under the direction of the Director of IT, who retains ownership of the program and of all systems and infrastructure. The Director of IT sets the program’s priorities and focus areas, approves all policies and standards, and makes the go or no-go decision on recommended remediation and program changes. The Information Security Analyst monitors and responds to security events, maintains the Information Security Management System (ISMS) and its registers, coordinates vulnerability remediation, maintains incident response and disaster recovery plans, governs identity and data access, and owns compliance and insurance evidence. The position is the day-to-day internal point of contact for security matters and turns findings into assigned, documented, and closed work.

ESSENTIAL DUTIES & RESPONSIBILITIES

Security Operations & Incident Response:

Investigate phishing, suspicious sign-ins, identity risk detections, and malicious domains. Sophos MDR is the primary detection and response layer, but Microsoft Defender, Entra identity protection, and Egnyte Secure & Govern can trigger first; the Analyst investigates and contains regardless of which platform alerted.

Own the phishing report process: triage employee-reported emails, determine whether they are malicious, coordinate blocking and cleanup, and give reporters timely feedback.

Respond in the order set by the Incident Response Plan: stop the active threat (secure accounts, isolate devices, block senders and domains), then contain and recover, then find the root cause and fix the system or process. Containment is taken on the Analyst’s own judgment within approved procedure and does not wait for prior approval.

Maintain and annually review the Incident Response Plan: severity model, roles, decision authority for system shutdowns and for insurer, legal, customer, and employee communication, escalation paths, communication templates, and response SOPs.

Plan and facilitate tabletop exercises with IT, Finance, Legal, and leadership (for example ransomware and business email compromise payment fraud); run post-incident reviews and track corrective actions to completion.

Disaster Recovery & Business Continuity: Maintain the ability to recover

Maintain the Disaster Recovery Plan for Director approval: recovery priorities, recovery time and recovery point objectives, and restoration runbooks for critical systems.

Coordinate backup verification and periodic restore and failover testing with the IT Systems Engineer, who operates the backup platform; document results and track gaps to closure.

Work with department leaders on business continuity procedures so operations can continue during an outage or incident.

Governence & ISMS: Maintain the Information Security Management System

Draft policies, standards, and procedures (acceptable use, access control, data handling, remote and mobile device use, and others) for review and approval by the Director of IT; the Director approves policy, sets priorities, and accepts risk.

Document security procedures in the Nox Group Standard Works format so they are consistent and repeatable across subsidiaries.

Keep the Risk, Exception, Compliance Obligations, CIS Control Mapping, and Vulnerability Advisory registers current and reviewed on a defined cadence; run the policy exception process.

Measure program maturity against the CIS Controls and NIST Cybersecurity Framework and recommend prioritized improvements for the program roadmap.

Vulnerability Management: Run the vulnerability lifecycle

Review platform findings and vendor advisories, confirm applicability and impact, and present recommended remediation and target dates to the Director of IT for approval.

Track approved remediation to closure and retain evidence; coordinate approved patch targets with the IT Systems Engineer, who owns the patch lifecycle.

Coordinate external assessments, including PCI ASV scanning and penetration testing, and manage the findings.

Identity & Access Governance: Govern access across the hybrid identity environment

Coordinate periodic access reviews of users, privileged roles, service accounts, and shared resources with IT and department leaders; drive removal of excess access.

Recommend requirements for MFA, passwordless authentication, Conditional Access, and privileged access for Director approval; the IT Systems Engineer administers the controls.

Review the joiner, mover, and leaver process for security gaps and verify offboarding is complete.

Data Protection: Maintain data security requirements

Maintain data classification, protection, retention, and recovery requirements and verify they are applied across file, email, and endpoint platforms.

Review data loss prevention, external sharing, and guest access findings and coordinate corrective action.

Vendor & Third-Party Risk: Oversee security vendors and assess third parties

Serve as the day-to-day contact for the MDR provider; review its reporting on a regular cadence and verify escalation contacts, response authority, and coverage (jobsite devices, subsidiaries, cloud tenants) stay current.

Perform security reviews of new software, SaaS, and vendors before adoption; document exceptions.

Compliance & Customer Assurance: Prepare evidence and support reviews

Own evidence and responses for customer, prime contractor, and cyber insurance security questionnaires, customer prequalification applications, and PCI DSS obligations.

Support audits and customer security reviews, including those from data center clients.

Security Awareness: Run the awareness program

Administer onboarding training, phishing simulations through Sophos Phish Threat, and targeted training for finance, field, and executive staff; track completion and follow up with teams that need support.

Use phishing report volume and simulation trends to shape training and awareness messaging; report results to IT leadership.

Reporting & Coordinator: Maintain visibility and work across the business

Communicate proactively with the Director of IT on program status, open risks, and upcoming deliverables; produce regular reporting on incidents, vulnerabilities, access reviews, and awareness results for the Director of IT and CIO.

Maintain security documentation, runbooks, and knowledge-base articles.

Partner with Legal, Accounting, People Operations, Safety, Procurement, department leaders, and executives to put security procedures into practice; coordinate with the IT Manager when IT Technicians are needed for remediation work.

Evaluate security tooling and services and present options and recommendations to the Director of IT; the Director decides what is adopted.

Other Duties: Perform other duties as assigned.

QUALIFICATIONS

Experience & Technical Qualifications

Entry-level position; relevant internship, co-op, or project experience in IT, cybersecurity, security operations, or compliance preferred.

Experience developing, writing, or maintaining policies, standard operating procedures (SOPs), or training materials is a plus.

Familiarity with cybersecurity frameworks, including NIST Cybersecurity Fra