IT Security Engineer

The IT Security Engineer ensures the security of systems and data. The IT Security Engineer is responsible for conducting vulnerability assessments, implementing security frameworks, managing risk, and complying with federal regulations. This position performs threat hunting and remediation activities to prevent and respond to cyberattacks. The IT Security Engineer has working knowledge of Tenable Nessus Cloud and Nessus Vulnerability Scanner, Acunetix Web Application Vulnerability Scanner, and the Federal Government ATO process. This position will use knowledge of threat hunting and vulnerability scanning and remediation processes.

ESSENTIAL JOB FUNCTIONS:

• Audits and evaluates existing data storage or transfer systems to identify weaknesses and assess risk; performs vulnerability testing.
  1. Conducts audits and/or assessments, to identify cloud-related risks and vulnerabilities and coordinates remediation activities
  2. Provides SME support for new and existing Cloud initiatives security systems for network, application, and databases; providing technical support as needed.
  3. Provides threat modeling and risk assessment to identify the risk and severity posture of various systems in cloud environments
  4. Collaborates in the design, development, and implementation of security standards.
• Implements new or upgraded security measures or controls, and documents system or policy changes.
  1. Assists in maintaining enterprise information security policies, technical standards, guidelines, and procedures necessary to support information security in compliance with established company policies, regulatory requirements, and generally accepted information security controls.
  2. Leads the creation of a common control framework, for use by all project teams in meeting ATO requirements.
  3. Works with all functions within the IT operations team to implement threat detection signals, deploy new tooling, and improve response capabilities.
  4. Identifies opportunities for security process improvement and assists in the further development of those processes.
• Reviews security violation reports or logs, investigates possible security exceptions, administers incident response procedures and coordinates with internal personnel or external agencies as needed.
  1. Tracks and reports on the effectiveness of cloud information security technology controls, processes, and policies.
  2. Assists with the investigation of security incidents, recommends, and implements solutions to remediate or mitigate threats and vulnerabilities.
• Ensures compliance with regulations governing data security or privacy (HIPAA, PII, etc.).
  1. Ensures compliance with security policies, standards, and procedures.
  2. Coordinates with firm IT Operations teams, including Systems, Network, Dev-Ops and Help Desk teams on implementation and support of key Microsoft/Azure/ O365 and AWS initiatives.
• Provides IT security subject matter expertise.
  1. Provides subject matter expertise with Office 365 and Microsoft Azure with emphasis in security products and processes such as ATP (Advanced Threat Protection), security policies for Office 365, Azure AD Identity Protection and Conditional Access (CA).
  2. Provides subject matter expertise in compliance and data retention, leveraging Office 365, Data Loss Protection. Provide architecture and security expertise for Microsoft Azure and AWS security technologies and strategy.
  3. Provides consultation on higher level services such as IaaS, PaaS and SaaS layers, Authentication/Authorization, Data encryption, Key management, and other security services.
  4. Maintains current knowledge of relevant security, privacy, and cloud technology trends.

MINIMUM JOB REQUIREMENTS:

Education: High School Diploma. Bachelor's preferred in technical discipline and/or demonstrated 10+ years industry experience. Certified Information Systems Security

Experience:

• At least 5 years of security engineering and Infrastructure experience.
• At least 5 years hands on experience managing IT Infrastructure solutions which includes operating systems, networks, DNS, firewalls, SSO, MFA, AWS, Azure, Active Directory, IaaS, PaaS, and SaaS.
• Familiar with industry security standards such as NIST cybersecurity framework, ISO 27001, OWASP Security Testing guidelines.
• A least 3 years' experience with security automation and orchestration (
• At least 5 years of administration and management of security technologies and products such as SIEM, data loss prevention, endpoint security, sandboxing, threat intelligence, pen testing and vulnerable vulnerability management, identity management.
• At least 5 years of experience as an Azure/O365 engineer.
• Familiarity with best practices for vulnerability management, risk analysis, reporting metrics and assessments.

Technical Knowledge:

• Working knowledge of Tenable Nessus Cloud and Nessus Vulnerability Scanner.
• Working knowledge of Acunetix Web Application Vulnerability Scanner.
• IT Security Framework Design, and Implementation, Security Risk Management with NIST or ISO 27k experience highly desired.
• Working knowledge of Federal Government ATO process.
• Working Knowledge of related FAR and FISMA regulations.
• General knowledge of threat hunting methodologies.
• General knowledge of vulnerability scanning and remediation processes.
• Proficient in Microsoft Office Suite, Adobe Acrobat, SharePoint, and other proposal development tools and software.

Competencies:

• Excellent communication skills, with the ability to influence and collaborate effectively across cross-functional teams.
• Strong analytical and strategic thinking abilities, coupled with a results-driven mindset.
• Ability to think creatively.
• Exceptional organizational skills, diligence, and the ability to manage multiple capture efforts simultaneously.

Language: English fluency (oral and written)

Physical Requirements:

• Extended Computer Use: Ability to sit for extended periods and operate a computer keyboard and mouse.
• Vision: Must be able to see and read computer screens and printed materials.
• Dexterity: Capable of using hands and fingers to operate equipment and perform tasks requiring precision.
• Communication: Able to effectively communicate verbally and in writing with team members and stakeholders.
• Mobility: Frequently required to stand, walk, reach, and bend to access office equipment and attend meetings.
• Lifting: Ability to lift and carry up to 50 pounds for short distances.
• Sensory Abilities: Must be able to perceive and interact with the environment using hearing and speaking skills.
• Work Environment: Primarily works in a typical office environment, with exposure to computer screens and moderate noise levels.

PREFERRED JOB REQUIREMENTS:

Education: Certification in business analysis or project management is a plus.

OTHER DUTIES AS ASSIGNED: This position description should not be construed to imply that these requirements are the exclusive standards of the position, nor will it be the sole basis for any subsequent employee evaluations. Incumbents will follow any other instructions and perform any other related duties as may be required by their supervisor.

APPLICATION INFORMATION:
If you meet the minimum requirements for this position, please click on the "Apply" link posted below and complete the application. Please include a cover letter, resume, and at least three (3) professional references.

Our company is an equal opportunity/affirmative action employer. Applicants can learn more about the company's status as an equal opportunity employer by viewing the federal "EEO is the Law" poster at EEOPost.pdf.

Qualified applicants will receive consideration for employment without regard to race, color, religion, sex, gender identity, sexual orientation, national origin, disability, or protected Veteran status.