Information Security Engineer II

OnPoint Credit Union•Portland, OR

About The Position

Implements and monitors information security programs and controls to protect technology and the business against unauthorized access, disclosure, modification, and deletion of information. Completes audit, reporting, information program, policy, procedure, technology, and incident-mitigation tasks. Provides security engineering advice for technology initiatives and helps ensure program conformance, end-to-end system and data security, and a near-zero-risk enterprise. Works with IT and business teams, vendors, and security tools to manage risks, test solutions, investigate incidents, and maintain data privacy and security. The role also uses approved AI tools responsibly and approved AI capabilities to support job duties and strengthen threat detection, triage, and response while complying with applicable policies. The work includes physical tasks such as installing or removing cabling and computer hardware, including work in communications closets, office settings, and server racks. The employee may use a ladder to access cables or hardware. The work environment is usually moderately noisy. Reasonable accommodations may be made to enable individuals with disabilities to perform essential functions.

Requirements

At least 3 years of information security experience or 6 years of information systems experience; financial services experience is preferred.
Must have or be able to obtain within six months of hire one of the following or an equivalent certification: Certified Ethical Hacker (CEH), Offensive Security Certified Professional (OSCP), CompTIA PenTest+, or SC-200 Microsoft Security Operations Analyst.
Bachelor’s degree in a related field or equivalent experience.
Advanced computer skills and practical knowledge of computing systems and software, including support desk solutions.
Must demonstrate conduct consistent with the company’s Corporate Values.
Ability to occasionally lift and/or move up to 50 pounds.
Vision abilities include color vision to identify colored labels, cables, and indicator lights.

Nice To Haves

Experience in the financial services industry.

Responsibilities

Establish and apply risk-management principles for consistent tracking and measurement in compliance with industry standards.
Serve as a security engineering technical advisor for technology initiatives and ensure program conformance.
Protect systems and data using perimeter threat-event reporting, data loss prevention, anti-spam and anti-virus solutions, and phishing simulations.
Analyze threat-event risks through simulations and communicate findings and training requirements to management and the business.
Use telemetry from security incident and event management and other solutions to support a near-zero-risk enterprise.
Test solutions using industry-standard analysis methods and deliver technical reports and documentation of test results.
Engineer security solutions efficiently, using a minimal technology footprint where possible.
Manage vendor solutions and partnerships with discretion to protect business and data privacy.
Audit and report on identity and access management to support a zero-trust framework for production and development business application systems.
Maintain awareness of evolving threats through professional organizations and information-security vendor partners.
Collaborate with IT and business teams on security initiatives and resolve security-related issues.
Monitor intrusion prevention technologies and perform vulnerability scans.
Escalate incidents when applicable and track completion of full event lifecycles.
Support investigations and processes focused on misuse of company data.
Capture evidence admissible in a court of law for unauthorized activities.
Use approved AI tools responsibly to improve productivity and support job-related duties while maintaining data privacy, security, and compliance with applicable policies.
Use approved AI capabilities to strengthen security, including threat detection, triage, and response, while maintaining data privacy, security, and compliance.
Install, remove, or terminate cabling and install or remove computer hardware, including hardware in server racks.