InfoSec Senior Engineer – Security Engineering & Architecture

Bank of Hope•Los Angeles, CA

About The Position

The InfoSec Senior Engineer – Security Engineering & Architecture is responsible for building security solutions that protect the business, but also allow the business to execute and innovate. The InfoSec Senior Engineer works closely with many diverse and dynamic teams, including, but not limited to, Security Engineering, IT Infrastructure, Application Development, Security Operations, Security Audit and End users. This position is also responsible for building solutions to secure business-to-business initiatives, third-party relationships, outsourced solutions, and vendors. The InfoSec Senior Engineer provides guidance for addressing current security issues but is expected to proactively deliver optimal secure solutions. The Engineer is expected to think like an adversary and identify how solutions should evolve as the threat landscape changes. The Engineer possesses strong communication and organizational skills, and the ability to guide less experienced coworkers. The Engineer provides technical leadership to delivery and solution engineering team members. Under the direction of the Information Security Director, develop strategies and plans to achieve security requirements and address identified risks. Assist in the development of security architecture and security policies, principles, and standards. Gather, analyze, and assess the current and future threat landscape, and assist in providing leadership with a realistic overview of risks and threats in the enterprise environment. Work with business units and with other risk functions to identify security requirements, using methods that may include risk and business impact assessments. Perform security testing and vulnerability assessments to identify security strengths and weaknesses, to assess the effectiveness of existing controls, and to recommend remediation action. Perform incident management and response activities as a member of the bank’s incident management team. As required, assist in triage, response and mitigation, postmortem analysis, and forensic analysis. Review audit trails, system logs and other monitoring data sources regularly and ensure they are in compliance with policies and audit requirements. Required to perform duties outside of normal work hours based on business needs. Assumes responsibility for other duties as required or assigned.

Requirements

Bachelor’s Degree in related field
8+ years of experience in technology risk management
In depth knowledge of risk assessment methods and technologies.
Proficient use of various tools and techniques, including risk, business impact, control, and vulnerability assessments, used to identify business needs and determine control requirements.
Excellent technical knowledge of Microsoft Windows operating systems and a wide range of security technologies, such as network security appliances, identity and access management systems, anti-malware solutions, automated policy compliance, logging and filtering tools, and desktop security solutions.
Knowledge of network infrastructure, including routers, switches, firewalls and associated network protocols and concepts.
Experience in system and application technology security testing, including static and dynamic code review, vulnerability scanning and penetration testing.
Experience with IDS/IPS/SIEM and related security tools and technologies.
Familiarity with router and firewall operations and maintenance.
Ability to interact with personnel at all levels and across all business units / organizations, and to understand business imperatives.
Strong knowledge in core internet protocols (e.g., TCP/IP, DNS, SMTP, HTTP, etc.)
Experience working with security tools such as SIEM, vulnerability scanning, laptop data encryption, endpoint data protection, and application pen testing.

Responsibilities

Develop strategies and plans to achieve security requirements and address identified risks.
Assist in the development of security architecture and security policies, principles, and standards.
Gather, analyze, and assess the current and future threat landscape, and assist in providing leadership with a realistic overview of risks and threats in the enterprise environment.
Work with business units and with other risk functions to identify security requirements, using methods that may include risk and business impact assessments.
Perform security testing and vulnerability assessments to identify security strengths and weaknesses, to assess the effectiveness of existing controls, and to recommend remediation action.
Perform incident management and response activities as a member of the bank’s incident management team.
Assist in triage, response and mitigation, postmortem analysis, and forensic analysis.
Review audit trails, system logs and other monitoring data sources regularly and ensure they are in compliance with policies and audit requirements.
Perform duties outside of normal work hours based on business needs.
Assume responsibility for other duties as required or assigned.