PS_Security Architect (Dodge & Cox)
The Security architect is highly technical and proficient with Information Security practices. The incumbent will be a self-driven technologist who works closely with others within the Security department as well as members of other Information Technology departments and business stakeholders to design, build, operate and monitor security infrastructure, platforms, applications and tools to meet strategic and tactical security objectives as outlined in the clients security information program. The Security Engineer will also lead security vulnerability assessments and work with technical managers, software development, and IT operations staff to mitigate or remediate vulnerabilities and manage technology risks across the enterprise.
The Security engineer will be responsible for the evaluation and implementation of a broad range of security technologies, processes and best practices. This calls for an experienced and resourceful engineer with the ability to interpret complex information and develop solutions to address security concerns in a timely manner. This role will also contribute to strategic information security operations and planning.
• Assist in the development of technology security requirements and standards aligned to business strategy, security policies and objectives, and technology development and operations processes
• Provide evaluation, analysis, development and implementation of IT Security systems/technologies across all security domains, including the necessary documentation to ensure manageability of the systems post implementation
• Enforce compliance with set controls, standards, policies and procedures while carrying out IT activities
• Search for and analyze security technology to reduce risks in every information security segment. Research and suggest measures to improve IT related procedures, operations, processes and systems, specific to information security concerns, throughout organization
• Suggest and execute IT technologies, strategies and policies to guard company's and customers information assets
• Assist in the security risk analysis for current and new systems and recommend solutions for reducing exposure areas
• Implement security program plans from the strategic unit of the security organization.
• Support and provide consultancy for audit compliance actions. Implement periodic, on-demand project audits
• Work with IT operations and software development staff to create mitigation and/or remediation plans, and manage regular and ad-hoc reporting to appropriate business and technology risk owners.
• Develop security processes, procedures and performance metrics; deliver regular and ad-hoc security reports and briefings to management and technical audiences, as needed.
• Develop and maintain documentation related to security processes, systems, procedures and events.
• Analyze system logs/interact with external SOC to identify suspicious activities and take appropriate action
• Assist infrastructure and application teams with prioritization of patches and security fixes following the vulnerability classification program
• Coordinate with different groups to ensure that all application, network and OS environments are patched on a regular basis
• Provide recommendations to mitigate risks through the appropriate use of technical, procedural, and administrative controls in accordance with legal and regulatory compliance standards and established industry best practice
• Serve as an information security engineering subject matter expert; deliver guidance and awareness of security standards and requirements in cross-functional technology project settings and through development and delivery of formal and informal information security training
• Bachelors Degree in Computer Science or Engineering, Management Information Systems, or a related technical field
• 6+ years of combined hands-on experience in technical security engineering, research and/or consulting
• Design Level Expertise with RSA (Security Analytics)-Required
• Websense, FireEye, Proof Point, Sentinel One, Semantics - Desired
• Demonstrated ability to build and operate technical security solutions at a global enterprise level
• Strong understanding of enterprise, network, system/endpoint, and application-level security issues and risks
• Strong understanding of TCP/IP networking; comfort working with Linux and Microsoft Windows-based system platforms
• Demonstrated experience with the following types of security technologies: distributed denial of service (DDoS) tools and services, network access control systems, network and application firewalls, IDS/IPS systems, data loss prevention, web proxy, vulnerability assessment platforms and tools, antivirus and malware prevention and analysis tools, and log management, correlation and security information and event management platforms and tools.
• Understanding of network, system and application hardening techniques, processes, tools, standards and benchmarks
• Experience with automating and scripting tasks in engineering or security incident handling scenarios
• Knowledge of IS27001, NIST 800 and similar standards is preferred
• Excellent communication skills.
• Propensity and willingness to learn new technologies.
• Self-starter, able to work in a fast paced environment and comply with tight deadlines.
• Detail-oriented, organized and analytical approach to performing work