Senior Security Engineer

RESPONSIBILITIES

·       Serve as a security expert in networks, endpoints, and enterprise applications efforts, helping project teams comply with enterprise and IT security policies, industry regulations, and best practices.

·       Manage vulnerability assessments on various types of networks and topologies;

·       Execute risk and vulnerability assessments and remediation activities.

·       Conduct penetration testing on IT infrastructure.

·       Analyze output from network vulnerability assessments, recommend mitigation strategies and resolve any security incidents through work with pertinent business departments.

·       Review and provide feedback on security plans and procedures regarding all aspects of LAN, WAN or MANs, as applicable;

·       Review and provide input into networks and endpoints designs to ensure compliance with security and enterprise architecture.

·       Review in-house and 3rd-party applications/code for security vulnerabilities and best practices.

·       Build/enhance security architecture and configure networks and endpoints to enhance the security posture of the enterprise.

·       Research, design, and advocate new technologies, architectures, and security
products that will support security requirements for the enterprise and its customers,
business partners, and vendors.

·       Participate in Software Development Lifecycle: code review, QA security testing, launches, etc.

·       Develop and/or implement automated security testing tools where possible.

·       Participate in the development of security-related tools and applications, such as multi-platform cookie-based authentication and internal security libraries/frameworks.

·       Train engineers on common security problems and best practices for writing secure code.

·       Performs hands-on testing of applications, as well as building and enforce information risk management requirements and structure, including providing practical secure architecture skills and developing and implementing Information Security best practices.

·       Lead and execute projects on our security roadmap.

·       Adhere to existing risk management frameworks, such as COBIT, ITIL, and ISO 27002.

·       Participate in managing incident response for network security events.

·       Develop and maintain IT security policies.

·       Provide input and visibility into emerging security technologies, deployment strategies and other security protocols to ensure awareness within the IT security branch.

MINIMUM QUALIFICATIONS, KNOWLEDGE, SKILLS, AND ABILITIES:

Formal Education & Certification

·       Bachelor's degree in information technology, Computer Sciences or equivalent. Master’s degree desirable

·       Possessing at least one professional security certification such as CISSP, CISM, CISA or similar.

Knowledge & Experience

·       7 years or more of professional experience in IT security including security policy development, security architecture models, and information security regulatory compliance

·       Must have the knowledge of IT security technologies such as firewalls, intrusion detections systems, antivirus, patch management, etc., and the interest and experience to work on security policy and architecture

·       Hands-on experience with the following technologies: enterprise system administration across multiple operating systems, IPS management (i.e., Cisco ASA, Palo Alto, TrendMicro), vulnerability scanning applications, Splunk

·       Experience in engineering and enterprise system administration roles.

·       Experience developing a standard set of metrics that measure our security posture on a
monthly/weekly basis.

·       Proven experience developing security policies, procedures, risk registers and incident
response plans

·       Intermediate to advanced knowledge of information security concepts.

·       Experience with one or more applications development languages such as Python, Go, Ruby on Rails, Java, C/C++, .NET.

·       Solid knowledge of and experience with secure web architectures, tools and processes

·       Knowledge of network architecture and design, network Security, wireless Security and client/server security. Very strong computer networking skills and understanding of networking protocols.

·       Security of virtual machine environments is highly desirable.

·       Expert knowledge and hands-on experience of vulnerability assessment/network discovery and associated tools

·       Understands infrastructure monitoring 

·       Expert in securing Linux and Windows systems.

·       Experience with various types of firewalls and technologies

·       Demonstrated process improvement experience

·       Previous application development experience is very helpful for secure code reviews

·       Hands-on experience using multiple Amazon Web Services and Azure technologies to support an enterprise environment.

·       Prior experience as a team lead or role mentoring junior team members.

·       Experience with threat detection and incident management for web applications

Skills & Abilities

·       Basic skills needed include:

-          Secure solutions development

-          Middleware security

-          N-tier apps dev infrastructure

-          Compliance – PCI, GLB, GLBA, CMMC. GDPR, etc.

-          Risk management and security risk assessments

-          Code review, reverse engineering

-          API’s and protocols

-          Authentication and authorization. SSO (Single Sign On), MFA (Multi- Factor Auth.).

·       Enterprise aware (change control, downstream impacts, understanding of cause and effect, change windows, etc.)

·       Recognized as a strategic thinker and is results oriented

·       Demonstrated effective strong team player and self-motivator. Ability to work and interface internally with an IT and other functional support groups with minimal guidance

·       Demonstrated successful experience in a customer-facing role

·       Demonstrated communicator both written and verbal, with effective presentation delivery and meeting facilitation 

·       Demonstrated effective time management, organizational and documentation skills

·       Good analytical and troubleshooting skills with strong attention to detail