Description
The Systems Security Engineering team is peers and partners with Platform Engineering (Windows, Unix & Virtualization (ESX) as well as Network Security Engineering (firewalls, network IDS/IPS etc.,) and is responsible for championing the security throughout the solutions development life cycle and providing SME support on various security topics such as with Access Control, Identity Management, Security Tools such as FIM, Configuration Compliance and similar controls.
RESPONSIBILITIES
Participate in new system build exercises or retrofitting compliance in an existing environment, understand and diagram the flow of the data, evaluate for confidentiality and availability risks during the flow of data and storage points, provide appropriate levels of access control and auditing to the solution, clearly articulate any security risks in both technical and business terms, propose mitigation strategies to mitigate, minimize or transfer the risk.
Work with a Matrix team consisting of a variety of Infrastructure Engineering groups, as well as Development groups and Client Relationship groups, understanding the projects and each groups needs while balancing securitys goals.
Senior level role that involves understanding client, business and project requirements and designing and deploying optimal security solutions that balance risk versus usability while meeting audit and compliance requirements.
Create high quality operational documentation, including Visio diagrams, high-level descriptions of the environment, as well as detailed instructions outlining the steps required to repeat the build-out and configuration of the infrastructure.
Day to day interaction with security technology providers, internal and external auditors, assessors, platform engineers (Windows, Unix and ESX) and Security Engineers with Security Operations groups.
Role sometimes requires scheduling and attendance on overnight maintenance windows.
Resource can expect to routinely be called upon to analyze and interpret results of security controls such as vulnerability scan reports, CIS hardening scan reports as well as provide recommendation for remediation of identified risks.
Participation in disaster recovery exercises, pre-production certification testing and troubleshooting events is expected.
Primary interface to security technology vendors such as Qualys, SecureWorks, Symantec, CA, Tripwire, SafeNet, RSA, Cyber-Ark to name a few
Create or help create legally-binding statements of work (SOW), project scope documents, project plans, business cases, and formal technical solutions recommendations.
Required to prepare recommendations and supporting details for formal proposals for security and compliance solutions.
FUNCTIONS
Travel approx. 10% of the year
EDUCATION and EXPERIENCE
Masters or Bachelors Degree in Computer Science or related technical field
10+ years of business experience, preferably in a service industry