IT Security Engineer, Level III

IT Security Engineer

The IT Security Engineer configures, implements, monitors and problem-solves security tools and processes for the protection of company computer systems, networks and information.

The position coordinates assessment, investigation, and reporting of security incidents to ensure the company knows as much as possible, as quickly as possible; and develops technical solutions and new security tools to help mitigate security vulnerabilities and automate repeatable tasks.

The position also contributes to information security policy maintenance; assists with design of security policy education, training, and awareness activities; and monitors compliance with Company security policies, regulatory requirements, and applicable laws. The position will work collaboratively with IT security custodians, Support Services, Application Development, Compliance Office, Facilities, Human Resources, Operations, and Client resources to monitor, assess, and fine-tune business continuity and disaster recovery programs, perform network penetration tests, vulnerability assessment scans and risk assessment reviews to maintain HIPAA Security Rule and PCI compliance.

• Proven work experience as a system security engineer or information security engineer
• Experience in building and maintaining security systems
• Detailed technical knowledge of database and operating system security
• Hands on experience in security systems, including firewalls, intrusion detection systems, anti-virus software, authentication systems, log management, content filtering, etc
• Experience with network security and networking technologies and with system, security, and network monitoring tools
• Thorough understanding of the latest security principles, techniques, and protocols
• Familiarity with web related technologies (Web applications, Web Services, Service Oriented Architectures) and of network/web related protocols
• Problem solving skills and ability to work under pressure
• BS degree in Computer Science or related field
• Experience designing secure networks, systems and application architectures
• Experience in a system administration role supporting multiple platforms and applications

• Responsible for administering risk management, threat management, and security monitoring tools.
• Monitor and consult on information security issues related to Company and 3rd party system, and workflow to ensure security controls are appropriate and operating as intended.
• Lead and oversee execution of IT security projects for the Company.
• Participate in internal HIPAA, PCI, ISO and HITRUST risk assessments.
• Coordinate and manage responses to information security incidents.
• Assist in the development of Information Security policies, procedures, standards and guidelines based on research, knowledge of best practices and compliance requirements.
• Conduct data classification assessment and security audits, and manage remediation plans.
• Perform security management functions by taking actions to mitigate risks, recommending security strategies, and ensuring controls are implemented and functional.
• Provide security governance by serving as oversight to ensure risks are adequately mitigated, and by aligning security strategies with business objectives and regulatory requirements.
• Interact with IT, Compliance, Facilities, HR and Operations management, legal counsel, safety and security, and law enforcement agencies to manage security vulnerabilities.
• Promote user security awareness.
• Conduct security research in keeping abreast of latest security issues, technologies, and trends.
• Prepare security documentation, including Company notifications and Intranet web content; contribute to Information Security Bulletin on Pulse community website.
• Contribute to weekly Security dashboard and management report to include the Company risk register, threat detections, compliance gaps, vulnerability exposures, and remediation activity tracker.
• Conduct periodic client-specific and enterprise service continuity/recovery testing.
• Actively participate in security and information protection communities, groups, and networks.
• P…