Information Security Engineer

GENERAL STATEMENT OF RESPONSIBILITY

Identify, implement and monitor security systems and processes for the protection of the computer systems, networks and data.

• Coordinate and execute on IT security projects.
• Identify and define system security requirements.
• Assist with the development and documentation of Information Security standard operating procedures and policies ensuring best practices for the organization.
• Develop strategies to respond to and recover from a security breach. Take a lead role in investigating security incidents, communicate information to management as quickly as possible to minimize risks and assist in root cause analysis.
• Select, architect, operate and configure systems to protect data and information infrastructure, including firewalls, data encryption, network devices, Intrusion Prevention Systems, security appliances and software, etc.
• Develop automated solutions for repeatable tasks.
• Conduct periodic scans of the networks to identify vulnerabilities.
• Conduct penetration testing to identity system weaknesses or process failures and help to remediate vulnerabilities.
• Monitor the organizations networks and systems for security events.
• Monitor computing environment and infrastructure logs, and network traffic for activities including but not limited to policy violations, abnormal behaviors, attacks, intrusions, best practice recommendations and security events.
• Recommend and perform system hardening for OnPrem and Azure / AWS Cloud Environments.
• Collaborate with internal resources to properly scope Identity and Access Management, configure roles and monitor for compliance.
• Generate queries for correlation of logs and events using a SIEM solution.
• Certificate and Key generation, issuance and management.
• Assist with Data Classification within the environment and develop governance controls.
• Assist in complying with SOC 2 Type 2 controls.
• Help maintain high security standards within SDLC and CI/CD pipeline for development practices.
• Develop strategy and coordination of disaster recovery and business continuity planning.
• Maintain and protect the confidentiality of all CRL, CRL subsidiaries, legal entities and client information.
• Comply with all applicable federal, state, and local safety and health regulations that would apply to this job.
• Keep work area neat and clean.

Other duties as assigned.

Bachelor’s Degree in Information Systems, Computer Science, Information Security or a related technical discipline, or the equivalent combination of education, professional training or work experience.

• 8 years IT experience
• 5 years of security specific experience with increasing responsibility
• Qualifications to acquire CISSP (ISC2), GISCP (GIAC), GSLC (GIAC), or CSQE (ASQ) certification within 12 months of hire required.

• Direct experience with anti-virus software, intrusion detection, firewalls and content filtering
• Knowledge of risk assessment tools, technologies and methods
• Experience designing secure networks, systems and application architectures
• Knowledge of disaster recovery, computer forensic tools, technologies and methods
• Experience in the development, deployment and maintenance of security policies, procedures, standards and strategies.
• Professional experience in a system administration role supporting multiple platforms and applications
• Ability to communicate network security issues to peers and management
• Ability to read and use the results of mobile code, malicious code, and anti-virus software
• Experience in Azure and/or AWS Cloud environments and associated security toolsets
• Experience managing security appliances e.g. F5, Firewalls, and SIEM solutions.
• Familiarity with IPS / IDS
• Experience with Web Security Proxies and Data DLP Solutions
• Experience creating queries with Splunk or other SIEM solution
• Knowledge of configuration and integration MFA solutions
• Working knowledge of Security Solutions.
• Understanding of the Encryption Protocols and managing high strength ciphers
• Working knowledge and understanding of SOC, ISO
  27001, or similar certification standards.
• Some scripting / Coding experience preferred:
  Bash, Power Shell, Java,…