Golden 1 Credit Union
IT - Info Sec Engineer - Information Security Engineer
Golden 1 Credit Union, Sacramento, California, United States, 95828
IT - Information Security Engineer
STATUS: EXEMPT
REPORTS TO: MANAGER – INFORMATION SECURITY
DEPARTMENT: IT – INFORMATION SECURITY
CODE: 11264
GRADE: 21S
PAY GRADE: $110,500.00 - $117,000.00 ANNUALLY
General Description The Information Security Engineer is responsible for securing our sensitive data and critical assets from current and emerging threats for Golden 1. This position utilizes business knowledge and technical experience of cybersecurity to provide a secure environment for Golden 1’s technology and information needs. The Information Security Engineer works closely with technology, application teams and business units to develop and test security structures designed to protect the computer and network infrastructure. This position is responsible for performing technical assessments of risks, threats and vulnerabilities related to new and existing information systems and supporting process within Golden 1 and external vendor connections.
Key Responsibilities
Analyze, assess, and respond to various internal and external threats identified by IDS/IPS, web application firewall, vulnerability scan results and other data sources. Provide recommendations to IT management and monitor to ensure that recommendations are effectively implemented.
Perform vulnerability assessments and penetration testing to identify exposures and risks, and report findings to management. Communicate and collaborate with partner teams, service owners, Information Security, and senior leadership to influence, prioritize, and drive the resolution of discovered security findings.
Provide consultative security guidance on a constant stream of new products and technologies as a subject matter expert on Golden 1 projects and initiatives.
Advise and participate in the development of business systems designs, ensuring hardening standards and configurations meet information security policy and procedures.
Work in conjunction with IT to ensure appropriate procedures and processes are in place and effective in the detection and prevention of system intrusions as well as in establishing and managing a functional anti-virus/malware/DLP policy.
Determine ways to monitor, measure, test and report on the effectiveness and efficiency of information security controls as well as compliance with information security policies and procedure.
Implementation, administration, and maintenance of IDS/IPS, URL filter, email gateway, certificate issuance and control, network management, identity access control, and other information security infrastructure and controls as necessary.
Regularly review IDS/IPS/SIEM rules, wireless rogue access point detection configuration and procedures and practices to ensure optimal effectiveness of security in the business environment.
Participate in creating access privileges, control structures and resources to ensure optimal efficiency and adherence to information security standards.
Engage with internal and external auditors during examinations, providing support and assistance in addressing audit recommendations.
Participate in the security development of network systems architecture, design, and ongoing review of system configuration in collaboration with relevant team members and external partners.
Keep management updated on outstanding issues that are not resolved in a timely manner in accordance with established escalation procedures.
Develop and maintain a clear understanding of the business area needs and incorporating these needs into technical solutions by updating, developing, and maintaining a thorough knowledge of credit union procedures, products, service, and data processing systems.
Monitor state and federal laws and regulations related to credit union compliance including Gramm-Leach-Bliley Act (GLBA), Payment Card Industry (PCI), Sarbanes-Oxley Act (SOX), etc. – and privacy laws.
Physical Skills, Abilities, and Exertion
Demonstrate strong oral and written communication skills with a focus on troubleshooting and error identification.
Must possess sufficient manual dexterity to skillfully operate applicable computer hardware, a variety of hand tools and standard office equipment.
Organizational Contacts & Relationships
INTERNAL: All levels of staff and management.
EXTERNAL: Vendors, service providers, organizational groups, and other financial institutions as needed.
Qualifications
EDUCATION:
Bachelor of Science in Computer Science, Management Information Systems, Information Security, Information Assurance or equivalent work experience.
EXPERIENCE:
3 years’ experience in organizational information security, cybersecurity, information assurance or providing security consulting services.
Working knowledge of traditional security controls and technologies, such as SIEM systems, IDS/IPS, public key infrastructure (PKI), IDAM systems, antivirus, and firewalls, in addition to newer offerings such as endpoint detection and response (EDR), threat intelligence platforms, security automation and orchestration, deception technologies and application controls.
Strong technical and analytical skills, with a background in technology design, implementation, and delivery.
Working knowledge SIEM systems, firewalls, threat intelligence, security automation and orchestration solutions, IDS/IPS, data loss prevention (DLP) and other network and system monitoring tools.
Demonstrates understanding of network systems and applications including: DNS, LDAP, virtualization, Database design/hardening, Email/secure messaging, Data Loss Prevention, and end point protection.
Demonstrates understanding of the NIST CSF and tracking KPIs to validate the cybersecurity program.
Strong sense of ethics, integrity, and professionalism.
Strong understanding of Windows, Linux, and cloud computing technologies, including software-, infrastructure- and platform-as-a-service, as well as public, private and hybrid environments.
Demonstrate the ability to articulate methodologies and concepts; communicate effectively in providing technical guidance and expertise to management and other staff.
Licenses/Certifications:
One of the following security certifications: CEH, Security +, SSCP, SANS GIAC, PCNSA, or equivalent.
Physical Requirements
Prolonged sitting throughout the workday.
Availability for emergency and on call duty 24 hours a day, 7 days a week.
Occasional travel may be required.
Lift and carry communications equipment and computer hardware weighing up to fifty pounds.
Corrected vision in the normal range required to configure, test, and troubleshoot network server hardware and data.
Hearing within normal range.
May work additional work hours to accomplish tasks.
Licenses/Certifications One of the following security certifications: CEH, Security +, SSCP, SANS GIAC, PCNSA, or equivalent.
Seniority level Not Applicable
Employment type Full-time
Job function Information Technology
Industries Banking, Consumer Services, and Financial Services
Travel Occasional travel may be required.
#J-18808-Ljbffr
REPORTS TO: MANAGER – INFORMATION SECURITY
DEPARTMENT: IT – INFORMATION SECURITY
CODE: 11264
GRADE: 21S
PAY GRADE: $110,500.00 - $117,000.00 ANNUALLY
General Description The Information Security Engineer is responsible for securing our sensitive data and critical assets from current and emerging threats for Golden 1. This position utilizes business knowledge and technical experience of cybersecurity to provide a secure environment for Golden 1’s technology and information needs. The Information Security Engineer works closely with technology, application teams and business units to develop and test security structures designed to protect the computer and network infrastructure. This position is responsible for performing technical assessments of risks, threats and vulnerabilities related to new and existing information systems and supporting process within Golden 1 and external vendor connections.
Key Responsibilities
Analyze, assess, and respond to various internal and external threats identified by IDS/IPS, web application firewall, vulnerability scan results and other data sources. Provide recommendations to IT management and monitor to ensure that recommendations are effectively implemented.
Perform vulnerability assessments and penetration testing to identify exposures and risks, and report findings to management. Communicate and collaborate with partner teams, service owners, Information Security, and senior leadership to influence, prioritize, and drive the resolution of discovered security findings.
Provide consultative security guidance on a constant stream of new products and technologies as a subject matter expert on Golden 1 projects and initiatives.
Advise and participate in the development of business systems designs, ensuring hardening standards and configurations meet information security policy and procedures.
Work in conjunction with IT to ensure appropriate procedures and processes are in place and effective in the detection and prevention of system intrusions as well as in establishing and managing a functional anti-virus/malware/DLP policy.
Determine ways to monitor, measure, test and report on the effectiveness and efficiency of information security controls as well as compliance with information security policies and procedure.
Implementation, administration, and maintenance of IDS/IPS, URL filter, email gateway, certificate issuance and control, network management, identity access control, and other information security infrastructure and controls as necessary.
Regularly review IDS/IPS/SIEM rules, wireless rogue access point detection configuration and procedures and practices to ensure optimal effectiveness of security in the business environment.
Participate in creating access privileges, control structures and resources to ensure optimal efficiency and adherence to information security standards.
Engage with internal and external auditors during examinations, providing support and assistance in addressing audit recommendations.
Participate in the security development of network systems architecture, design, and ongoing review of system configuration in collaboration with relevant team members and external partners.
Keep management updated on outstanding issues that are not resolved in a timely manner in accordance with established escalation procedures.
Develop and maintain a clear understanding of the business area needs and incorporating these needs into technical solutions by updating, developing, and maintaining a thorough knowledge of credit union procedures, products, service, and data processing systems.
Monitor state and federal laws and regulations related to credit union compliance including Gramm-Leach-Bliley Act (GLBA), Payment Card Industry (PCI), Sarbanes-Oxley Act (SOX), etc. – and privacy laws.
Physical Skills, Abilities, and Exertion
Demonstrate strong oral and written communication skills with a focus on troubleshooting and error identification.
Must possess sufficient manual dexterity to skillfully operate applicable computer hardware, a variety of hand tools and standard office equipment.
Organizational Contacts & Relationships
INTERNAL: All levels of staff and management.
EXTERNAL: Vendors, service providers, organizational groups, and other financial institutions as needed.
Qualifications
EDUCATION:
Bachelor of Science in Computer Science, Management Information Systems, Information Security, Information Assurance or equivalent work experience.
EXPERIENCE:
3 years’ experience in organizational information security, cybersecurity, information assurance or providing security consulting services.
Working knowledge of traditional security controls and technologies, such as SIEM systems, IDS/IPS, public key infrastructure (PKI), IDAM systems, antivirus, and firewalls, in addition to newer offerings such as endpoint detection and response (EDR), threat intelligence platforms, security automation and orchestration, deception technologies and application controls.
Strong technical and analytical skills, with a background in technology design, implementation, and delivery.
Working knowledge SIEM systems, firewalls, threat intelligence, security automation and orchestration solutions, IDS/IPS, data loss prevention (DLP) and other network and system monitoring tools.
Demonstrates understanding of network systems and applications including: DNS, LDAP, virtualization, Database design/hardening, Email/secure messaging, Data Loss Prevention, and end point protection.
Demonstrates understanding of the NIST CSF and tracking KPIs to validate the cybersecurity program.
Strong sense of ethics, integrity, and professionalism.
Strong understanding of Windows, Linux, and cloud computing technologies, including software-, infrastructure- and platform-as-a-service, as well as public, private and hybrid environments.
Demonstrate the ability to articulate methodologies and concepts; communicate effectively in providing technical guidance and expertise to management and other staff.
Licenses/Certifications:
One of the following security certifications: CEH, Security +, SSCP, SANS GIAC, PCNSA, or equivalent.
Physical Requirements
Prolonged sitting throughout the workday.
Availability for emergency and on call duty 24 hours a day, 7 days a week.
Occasional travel may be required.
Lift and carry communications equipment and computer hardware weighing up to fifty pounds.
Corrected vision in the normal range required to configure, test, and troubleshoot network server hardware and data.
Hearing within normal range.
May work additional work hours to accomplish tasks.
Licenses/Certifications One of the following security certifications: CEH, Security +, SSCP, SANS GIAC, PCNSA, or equivalent.
Seniority level Not Applicable
Employment type Full-time
Job function Information Technology
Industries Banking, Consumer Services, and Financial Services
Travel Occasional travel may be required.
#J-18808-Ljbffr