Cyber Security Engineer

Redhill, United Kingdom

Supports the handover of existing security tools, including oversight and management of access control, technical management of security materials such as cryptographic keys, passwords and certificates, as well as additionalsecurity monitoring, vulnerability management, tool maintenance and configuration.

The role will also provide knowledge transfer and training to thesuccessor operator’s security architecture staff.

• Ensure RCC Handover project objectives are supported by appropriate cybersecurity requirements.
• Define, document and perform technical changes in security tooling to support RCC Handover.
• Lead cybersecurity assurance within RCCHandover change boards and design gateways.
• Ensure appropriate security support processes are followed by the RCC Handover team.
• Ensure the customer and successoroperator understand the technical impact of RCC Handover tasks.
• Provide input into other cybersecurity,contingency planning and related RCC Handback activities.
• Create and update technical documentation for security tools, processes and information assets as directed by theRCC Handover leadership team.
• Assess RCC Handover change controlrequests for potential impact on existing security mechanisms and ensureany potential compromise or weakening of security controls is minimised.
• Perform security monitoring and vulnerability management of information assets in scope of RCC Handovertasks, supporting existing business-as-usual teams.
• Perform handover of security secretmaterials, including cryptographic keys and certificates, devices andaccess control credentials to the customer and/or successor operator.
• Provide reporting to the RCC Handbackleadership team.
• May be required to work across customer,TfL, successor operator sites and data centres.
• Comply with all relevant company policies and procedures, including standards relating to conduct, quality,security, occupational health, safety and environmental requirements.
• Perform any other reasonable duties assigned by the manager from time to time.

• Certification as an Information Securityprofessional, for example:
• IISP
• CISA
• CISM
• CISSP
• CCSP
• ISA
• University degree in a numerate subjectsuch as Computer Science, Mathematics, Engineering or Natural Sciences.
• Information privacy/data protectioncertifications such as CIPP/E and CIPM.
• CREST-registered penetration testerand/or security architect.
• ITIL v3, PRINCE2 Foundation and/or TOGAF.
• Security, IT infrastructure or networkingvendor certifications.

• Strong experience taking a leading rolein the establishment and implementation of security architecture, policies and procedures.
• Good understanding of enterprise-scalesecurity management processes and infrastructure.
• Experience working with current IT security standards and regulations such as PCI-DSS, ISO 27001 and UK data protection legislation.
• In-depth understanding of information security control tools, for example:
• Splunk Cloud
• Crowd Strike
• Qualys
• Trellix
• CiscoIPS
• F5
• Centrify
• Experience working with enterprise IT infrastructure and technologies such as Microsoft Windows Server, Ciscoand Linux.
• Experience with in transactional revenue,embedded systems, smart cards and mobile payment systems.
• Knowledge or experience of security architecture across major public cloud services such as:
• Amazon Web Services
• Google Cloud
• Cloud Access Security Brokers
• Knowledge of cryptographic services,products and HSM devices.
• Knowledge of wider security, audit, riskand compliance standards including:
• PCI-P2PE
• PCI-POI-PTS
• ISO
  27701
• ISO
  27005
• ISO
  31000
• NIST
• GDPR
• Governance,Risk and Compliance tools
• Experience with quality management systems and external audit standards such as ISO 9001.