Description
Services to be delivered
- Assisting with the information security review of automation projects and providing information security related advice to the staff managing and working on those projects.
- Understand the challenges and threats facing the business and translate this understanding into sound security requirements for new and existing IT Infrastructure that effectively mitigate identifiedrisks whilst allowing the business to continue to operate effectively.
- Complete technical risk assessments as necessary.
- Identify system vulnerabilities as necessary and complete or propose work to test the security of a system using specialists in penetration testing.
- Collaborate with the architecture team with translating the security requirements into a security architecture.
- Monitoring and advising on information security issues related to the systems and processes at our Client to ensure that the Client's security controls effectively mitigate risk and operating as intended.
- Collaboration with IT management, the legal department and the operational IT and physical security groups to support security management implementation and enforcement while representing the security team in a positive light, ensuring that it is seen as a business enabler.
- Assisting with responses to information security incidents and vulnerabilities.
Qualifications, skills and experience
- 7 years+ of progressive experience in IT Infrastructure and information security, including experience broad experience in securing Internet technologies.
- Strong analytical and problem solving skills.
- Ability to communicate (oral, written, presentation) in English, interpersonal and consultative skills.
Highly Desirable:
- Demonstrable broad knowledge and hands-on experience of infrastructure technologies through the entire infrastructure stack, including: network, virtualisation, SAN, server OS (Windows and UNIX) and common Business technologies (for example, SQL Server, SharePoint). Technical knowledge of and experience working with computer systems and the application of security to those systems.
- Knowledge and practical experience of security risk assessment following ISO 27005 and/or eSABSA standards and methods.
- Knowledge of information security standards, in particular ISO 27001 & 2, rules and regulations related to information security and data confidentiality and desktop, server, application, database, network security principles for risk identification and analysis.
- Experience should include security policy development, security education, risk nalysis and compliance testing.
- Experience in large, international organizations.
- Experience with application security.
- CISSP, GIAC, or other security certifications and/or membership of a rofessional institution representing security professionals.
Desirable:
- System penetration testing, application vulnerability assessments.
- Security Incident Management, including incident analysis.
- SABSA, TOGAF, experience and/or certification.
Technical knowledge and Expertise
- Firewalls
- IDPS
- VPN technologies, including SSL.
- Web Access Management
- Malware protection
- Authentication technologies such as Radius, Kerberos, Single-Sign On, Vasco tokens, Federation (SAML, WS-Fed), WebSSO, two factor authentication
- Authorization including RBAC, Rules based authorization
- LAN, WAN and SAN concepts and technical implementations
- Mainframe, Windows, Unix, Linux Operating Systems
- Identity Repositories including LDAP, Active Directory, RACF
- IAM suites including Microsoft FIM 2010, Microsoft ADFS