Job Description: PRIMARY FUNCTION: The Security Engineer provides technical leadership in designing, engineering, testing, and deploying security architectures, configurations, and controls to meet VACU security needs. This role ensures secure design of VACU's computer systems, infrastructure, and network connections. Maintains security best practices and solutions while possessing an understanding of risk and compliance. Identifies security measures to maintain security and privacy compliance. This position will analyze and resolve security breaches and vulnerability issues in a timely and accurate fashion, and conduct user activity audits where required. Individual will be responsible for the implementation and daily monitoring of information security controls and work with the Information Technology staff and the Information Security Analyst to assess system security.
JOB DUTIES AND RESPONSIBILITIES:
- Ensure high-level integration of IT Systems development with security policies and information protection strategies
- Deploy, manage and maintain all security systems and their corresponding or associated software, including firewalls, intrusion detection systems, and cryptography systems.
- Conduct security reviews, evaluations, risk assessments, and develops recommendations for improvements as appropriate
- Monitor and evaluate emerging security alerts/issues, recommend remediation alternatives
- Design, perform, and/or oversee penetration testing of all systems in order to identify system and application vulnerabilities.
- Monitor server logs, firewall logs, intrusion detection logs, and network traffic for unusual or suspicious activity
- Coordinates information protection activities and projects with other groups within VACU, business partners, vendors of information protection services, and other organizations to ensure effective definition, development, and implementation of appropriate information protection measures
- Recommend, schedule (where appropriate), and guide recovery procedures, and any other measures required in the event of a information technology security incident
- Assist VACU's Information Security Analyst and Information Technology management in the development and implementation of appropriate security controls to maintain compliance with security and/or privacy regulations.
- Acts as team member in the development, maintenance and testing of the Business Resumption plan (as it relates to Information Systems Security).
- Conduct research on emerging products, services, protocols, and standards in support of security enhancement and development efforts.
- Effectively plan and manage assigned activities to ensure that objectives and schedules are met.
- Other duties may be required and assigned by the supervisor
• Complete all required BSA and OFAC training. Report all suspicious activity to Security. • Assist in development and management of the IT Budget
JOB QUALIFICATIONS: Knowledge: - Significant knowledge of the following:
- IPSec and VPN - IDS/IPS - Firewall configuration - Various filtering and access control techniques - Email and external messaging protocols and security techniques - InfoSec Policies and establishing associated controls - Penetration Testing - Incident handling/response - Security auditing - SSL Certificates - Wireless security - Security architecture - Multi-factor authentication - Defense in depth methodologies - Desktop, Server, and application security best practices
- In-depth knowledge of network, PC, and platform operating systems.
- Working technical knowledge of current systems software, protocols, and standards.
• Knowledge of applicable practices and laws relating to data privacy and protection.
Skills: Abilities: - Ability to identify and prioritize issues and provide strong customer service.
- Ability to collaborate and influence to persuade others to comply with established security policies.
- Ability to handle proprietary and sensitive information in a confidential manner.
- High level of analytical and problem-solving abilities; attention to detail.
Minimum Education and Experience: • Bachelor's degree in the field of computer science, information security and/or equivalent work
- Certified Information Systems Security Professional (CISSP), or other security certifications a plus.
- Hands-on experience with firewalls, intrusion detection systems, anti-virus software, data encryption, and other industry-standard security related technologies, techniques and practices.
- Experience or familiarity with virtualization, SAN, clustering, redundant and high availability systems, TCP/IP stack.
- Experience responding to information security incidents
- Experience with IT Security Audit Logging, Detection, Aggregation, Analysis, Response and Mitigation; experience with Security Incident Management processes.
- Experience working in a team-oriented, collaborative environment.
- Experience with using security penetration testing tools, vulnerability scanners, scripting and other techniques used to identify network and host vulnerabilities
- Experience supporting technical security audit teams during execution of security audit plans and Security Testing and Evaluation plans
PHYSICAL REQUIREMENTS: • This job requires the ability to sit for long periods of time. • This job requires occasionally lifting up to 50 pounds and/or up to 30 pounds frequently.