Information Security Engineer IV

The Information Security Engineer IV is a key member of the cyber security team that is responsible for designing and implementing security solutions that protect the Firm from internal and external threats, while also enabling the business to execute and innovate. This role is responsible for managing the controls that protect the organization's computer networks, systems, and data from cyberattacks, working closely with IT teams to identify, assess, and mitigate security risks, and supporting incident response to contain the damage from security incidents and prevent future attacks.

The Information Security Engineer IV provides guidance for addressing current security issues and possesses effective communication and organizational skills, with the ability to guide less experienced coworkers. In this role, the engineer anticipates client needs, proactively identifies ways to improve client satisfaction, and takes a broad perspective to solve complex problems by identifying and implementing innovative solutions.

The Information Security Engineer IV is accountable for planning and executing security projects to improve the Firm's overall security posture, for creating and maintaining security-related documentation, and for other various security-related tasks. The position is responsible for the protection of all Information Assets, including physical and digital data, technology infrastructure, cloud and on-premise applications, user endpoints, and other Technology Resources. The ideal candidate is passionate about security, is intellectually curious, and thrives on learning and teaching alike.

ESSENTIAL JOB FUNCTIONS:

• Research, design, and implement cybersecurity solutions for the organization's systems and products in compliance with the organization's applicable security policies and standards.
• Research, validate, and deploy solutions meeting security and business needs.
• Work with IT and internal and external business partners to ensure that security is factored into the evaluation, selection, installation, and configuration process of hardware and software.
• Analyze and make recommendations to improve network, system, and application architectures.
• Define and document how the implementation of a new system or new interfaces between systems impacts the security posture of the current environment.
• Remain current with new security threats and assess systems to ensure they can defend the business.
• Evaluate and implement new security technologies to address emerging threats.
• Build and administer core network and systems security controls, including:
  Next Gen firewalls, ZTNA - Zero Trust Network Architecture, intrusion detection and prevention, anti-malware, application whitelisting, host intrusion prevention, endpoint detection and response (EDR), vulnerability scanners, content monitoring/filtering, and security monitoring (SIEM).
• Plan and execute Information Security projects. Represent the security team on projects owned by other IT teams.
• Perform security and privacy reviews of IT services and changes (e.g., new technologies being added to the environment or that are undergoing significant changes). Monitor change management database activity to stay abreast of developments in the IT environment.
• Conduct regular security assessments to identify vulnerabilities and potential risks.
• Collaborate actively with senior technologists on other IT teams to design solutions that satisfy the priorities of each individual IT team involved, while also providing the best possible user experience and appropriate security assurance.
• Establish architectures and baseline configurations for various security technologies, including: anti-malware, endpoint detection and response (EDR), security monitoring, systems security, network security, identity and access management, public-key infrastructure (PKI), deception technologies, DLP, and web/email content filtering.
• Design and maintain strategies for Information Security documentation, including runbooks, procedures, processes, and hardware and software inventory detail.
• Implement and operate technical security solutions across a wide range of technologies and serve as a third-tier support resource and SME for these technologies as required.
• Serve as a member of the Computer Security Incident Response Team (CSIRT), assisting with incident response (IR) with the IR and security operations center (SOC) efforts.
• Assist in the review and update of cybersecurity policies, architectures, and standards.
• Assist with threat and vulnerability management activities, including triage of new vulnerabilities, root cause analysis, threat modeling, and mitigation planning.
• Apply cybersecurity tools and techniques to automate security tasks, streamline incident response, and enhance overall security posture.
• Automate workflows for security processes and procedures. Identify and drive improvements to Information Security programs.
• Assist with Information Security program management, including defining and…