Senior Engineer, Information Security

OPERATIONAL SUPPORT (25%)

• Coordinate, measure and report on the technical aspects of security management.
• Manage and coordinate operational components of incident management, including detection, response and reporting.
• Maintain a knowledgebase comprising a technical reference library, security advisories and alerts, information on security trends and practices, and laws and regulations.
• Manage the day-to-day activities of threat and vulnerability management, identify risk tolerances, recommend treatment plans and communicate information about residual risk.
• Assist and guide in the development, testing and maintenance of disaster recovery and incident response plans.
• Respond to and, where appropriate, resolve or escalate reported security incidents.
• Monitor system logs, SIEM tools and network traffic for unusual or suspicious activity. Interpret such activity and make recommendations for resolution.
• Investigate and resolve security violations by providing postmortem analysis to illuminate the issues and possible solutions.
• Assist as needed with the monitoring of internal control systems to ensure that appropriate information access levels and security clearances are maintained.

Strategic Support (25%)

• Collaborate in developing a security program and security projects that address identified risks and business security requirements.
• Manage the process of gathering, analyzing and assessing the current and future threat landscape, as well as providing management with a realistic overview of risks and threats in the enterprise environment.
• Monitor and report on compliance with security policies, as well as the enforcement of policies within the IT department.

Security Liaison (25%)

• Assist in security communication, awareness and training for audiences, which may range from senior leaders to field staff.
• Work as a liaison with vendors and the legal and purchasing departments to establish mutually acceptable contracts and service-level agreements.
• Manage production issues and incidents, and participate in problem and change management forums.
• Work with various stakeholders to identify information asset owners to classify data and systems as part of a control framework implementation.
• Serve as an active and consistent participant in the information security governance process.
• Work with IT and business stakeholders to define metrics and reporting strategies that effectively communicate successes and progress of the security program.

Architecture/Engineering Support (25%)

• Consult with IT and other staff to ensure that security is factored into the evaluation, selection, installation and configuration of hardware, applications and software.
• Recommend and coordinate the implementation of technical controls to support and enforce defined security policies.
• Research, evaluate, design, test, recommend or plan the implementation of new or updated information security hardware or software, and analyze its impact on the existing environment; provide technical and managerial expertise for the administration of security tools.
• Develop a strong working relationship with the IT team to develop and implement controls and configurations aligned with security policies and legal, regulatory and audit requirements.