The Information Security Program supports Human Rights Watch (HRW) and its counterparts in being responsive to near- and far-term security threats, ensuring that HRW makes informed decisions about the responsible use of technology, and providing technical knowledge and expertise in areas such as targeted government hacking, censorship, surveillance, encryption, data privacy, and digital forensics.
The Information Security Program is seeking an Information Security Technologist to be responsible for the delivery and maintenance of HRW security tools and services. The position will include active engagement with our civil society security counterparts and partners to ensure we are contributing to, and benefitting from, collective efforts to improve and monitor issues relating to information security. The Technologist will also work in collaboration with the wider HRW security team to perform security reviews, identify gaps in security architecture/process, develop security risk management and monitoring plans, and provide guidance and support to HRW staff. As time allows, the Technologist may also serve as a resource for technical knowledge, assistance, and investigative collaboration for HRW’s research and technology teams.
The Technologist is preferably based in a major HRW office but other locations may be considered. This position reports to the Director of Information Security, who is based in New York.
HRW is keen to hear from people who consider themselves under-represented in the security and/or technology communities – even if they feel they meet only some of the qualifications.
- Lead in the identification, development, evaluation, customization, installation, operation, and maintenance of security tools and systems;
- Participate in technology evaluation and design of security controls during HRW system evaluation, development, and ongoing review. Help ensure processes, systems design, and configuration provide security that is responsive to our threat landscape while being able to meet HRW’s operational, ethical, legal, and regulatory requirements;
- Develop and implement procedures to prevent and defend against unauthorized access to systems, networks, and data, and assist in the development of security contingency plans and disaster recovery procedures;
- Liaise with HRW’s technology and IT teams to ensure the design, strategy, and implementation of HRW security monitoring practices are consistent with HRW’s overall security objectives;
- Work with our partners and counterparts to establish, maintain, and contribute to active threat information-sharing channels that ensure HRW and its counterparts are responsive to near- and far-term threats;
- Assist with technical and security emergencies as needed; troubleshoot and work with other members of the security team, IT, and affected HRW staff to resolve issues;
- Create and maintain high quality, accurate, and in-depth data and documents on information security processes, technologies, and/or related coverage areas;
- Deliver outputs in a timely manner and be consistent with the agreed strategy and priorities of the Information Security Director;
- Travel internationally, as required; and
- Carry out any other duties as required.
- A keen interest in implementing and maintaining processes and technologies to help HRW’s employees, partners, and sources work safely and securely is required.
- Proven ability to code and script to automate common activities and effectively implement various security tools is required.
- Development skills with high-level scripting languages (i.e. Python [preferred], Ruby, etc.) with a mastery of at least one coding language is required.
- Ability to clearly document and communicate security findings, risk description, risk level, and recommended solutions to stakeholders is required.
- Experience using IT automation software such as Ansible, Puppet, and/or Chef is preferred.
- Proven ability to simplify processes and promote low friction security is preferred.
- Ability to develop secure software according to secure software deployment methodologies, tools, and practices is required.
- Ability to configure and validate network workstations and peripherals in accordance with approved standards and/or specifications is required.
- Previous experience working in the human rights field is not required.
Related Skills and Knowledge:
- Optimism, a sense of humor, and excitement about joining a supportive, skilled, and diverse team.
- Ability to identify opportunities for automation and scripting.
- Ability to explain complex technical subjects clearly and respectfully to audiences of specialists in non-technical fields.
- Excellent ability to work collaboratively and respectfully with others in multicultural teams, across organizational boundaries and multiple time zones, and with employees at all levels of the organization.
- Knowledge in determining how a security system should work (including its resilience and dependability capabilities) and how changes in conditions, operations, or the environment will affect these outcomes.
- Knowledge of basic software applications and the types of vulnerabilities that have been found in those applications.
- Knowledge of Unix/Linux and Windows operating systems structures and internals. (e.g., process management, directory structure, installed applications).
- Knowledge of capabilities and applications of network equipment including routers, switches, bridges, servers, transmission media, and related hardware.
- Ability to simultaneously handle multiple projects effectively and adjust to changing priorities.
- Strong critical thinking/analytical skills, creativity, and a proven drive for quality.
HRW seeks exceptional applicants and offers competitive compensation and employer-paid benefits. HRW offers a relocation assistance package and will assist employees in obtaining necessary work authorization, if required; citizens of all nationalities are encouraged to apply.