Engineer, IT Information Security Operations

Responsibilities

• Monitor and manage the Information Security request queue, including analysis and resolution of outstanding issues.
• Manage endpoint and network security environments including overall health, policy modifications, troubleshooting/resolving issues and producing monthly health metrics for workstations, servers, and identities.
• Work directly with the Information Security Team and Security Operations Center (SOC) to analyze and resolve security events/alerts. This includes some monitoring and management of the SIEM platform.
• Manage and maintain Information Security training and awareness campaigns (e.g., training, phishing). Developing/monitoring campaigns, ensuring required training is complete, producing reports/metrics and recommending improvements to the current process.
• Conduct internal security control testing. Includes gathering, uploading, and reviewing evidence within the GRC (Governance, Risk and Compliance) tool. Supporting PCI, SOC and related audits.
• Other duties as assigned.

• Security focused degree and/or certifications a plus (e.g., BS/MS in Cybersecurity or related discipline, CISSP, CISA, etc)
• 3+ years of Information Security / Cybersecurity experience
• Strong knowledge of Information Security / Cybersecurity related technologies, processes, and tools.
• Minimum working knowledge of penetration testing, vulnerability management, SIEM/log analysis, TCP/IP, OSI Model, network security, endpoint security, identity and access control, Active Directory, Windows/Linux security, email security, DLP concepts, policy and governance, detection/monitoring, incident response, authentication concepts and asset discovery.
• Network security concepts and products (e.g., firewall (Cisco, AWS Network Firewall), network (e.g., Cisco, Meraki), email (O365, Avanan), IDS/IPS (e.g., Snort, Suricata). Cisco Umbrella a plus).
• Endpoint security products and concepts (e.g., malware protection, network protection, forensics, DLP, compliance. Bitdefender and Incydr a plus).
• Security monitoring (SIEM), analysis and resolution of security events/alarms. Alien Vault a plus.
• Identity and access management concepts (e.g., Azure Active Directory, SSO, user access reviews).
• Implementing NIST CSF, CIS top 20, SOC 2, PCI, HIPAA or related security frameworks.
• Implementing Amazon AWS security tools and concepts.
• Identifying assets (e.g., servers, network devices, applications), identifying network layouts and determining security risk and potential solutions.
• Strong analytical skills, detail oriented, ability to work autonomously or in groups toward a common goal, resourceful and able to make progress quickly and ability to build relationships, influence and educate on matters related to cybersecurity.