Manager, IT Security

Overview

Role

Purpose:

The Senior Cyber Security Engineer will design and implement IT security systems to protect the organization's computer networks from cyber-attacks. This position will also help develop best practices for IT security. They will monitor systems, applications, and networks for security issues, install security software, and document all security issues or breaches they find.

This is an individual contributor role with accountability for regional IT security outcomes and work done by security contractors; this role does not include direct management of employees.

This position will work closely with members of the IT Operations team to coordinate efforts related to improving the security posture of the organization, as well as the coordination and execution of Security Incident Response efforts. This person will be viewed as a Subject Matter Expert in terms of security concepts and technologies, as well as related concepts such as AI and privacy.

• Deploy, tune and monitor intrusion detection/prevention systems (IDS/IPS), Security Information and Event Management (SIEM) tools, endpoint security (MDR/XDR) tools, Cloud Security Posture Management (CSPM) tools, email gateways, firewalls, network infrastructure and other appliances for security issues.
• Work in a single global team across a multi-organization, multi-country enterprise to help define and maintain a global security program.
• Lead investigative processes towards identifying root cause of security events, evaluate incoming security alerts and anomalous activity, and recommend or adjust detection settings when necessary to reduce false positives.
• Collect and perform forensic analysis of network packet captures, live memory and drive acquisitions, malware samples, as well as logs from various types of security sensors, applications, and operating systems.
• Investigate security breaches and other cybersecurity incidents, followed up with all necessary documentation.
• Maintain industry awareness of threats and capabilities to provide guidance on security tooling selection and implementation - closing the gap in endpoint and network visibility across the enterprise.
• Participate in Security Architecture reviews for new projects to ensure proposed solutions align with risk requirements (revising or creating architectural-level documentation as needed)
• Participate in the design and execution of vulnerability assessments, penetration tests, and security audits.
• Work with IT Infrastructure, IT Operations, and IT Applications stakeholders to facilitate the remediation of detected vulnerabilities to maintain a high-security standard.
• Document best practices using available collaboration tools and work spaces.
• Collaborate to define IT Security standards and develop supporting organizational policies.
• Support vendor due-diligence process and help to lead and define overall third-party risk management efforts for IT vendors and contractors.
• Support internal and external audit process for relevant compliance concerns including SOX, CCPA, and GDPR requirements.
• Participate in disaster recovery and business continuity planning and test exercises.

Education and/or

Experience:

Required:

Associate degree with 4 years of experience working in an Information Security role, OR bachelor's degree with 2 years of experience working in an Information Security role, OR 6+ years of relevant experience in a technical security role.

Preferred:

• GIAC:
  Certified Incident Handler
• GIAC:
  Certified Enterprise Defender
• GIAC:
  Security Essentials (GSEC)
• (ISC)2: CISSP, SSCP, CCSP, CGRC, ISSAP, ISSEP, ISSMP
• EC-Council: CEH, CPENT, CHFI, CND, CCSE, ECDE, ECIH, CTIA
• CompTIA:
  Security+, CASP+

• Overseeing Security Information and Event Management (SIEM) technologies and effectively managing alerts. Tuning, as necessary to avoid false negatives and false positives.
• Experience running and leading incident response, including playbooks, tabletops, IR vendors and responding to security events.
• Experience analyzing log sources originating from security and networking devices such as firewalls, routers, proxy,…