IT Security Architect - BCDR

UMC Health System•Richmond, KY

About The Position

We’ve learned that what is best for patients is also best for employees. Learn more about why we are one of the Best Companies to Work for in Texas®. Job Summary We are seeking a Professional for an IT BCDR (Business Continuity Disaster Recovery) role. A candidate with strong Business Continuity experience that could step in and develop our program to maturity. A candidate who could review and critique the existing plans and help analyze the overall DR/BCP approach would be of great value. The Business Continuity & Disaster Recovery Architect is responsible for the hands-on management of the Business Resiliency program. This position requires a proven subject matter expert with demonstrated competency in the planning, development, program execution, maintenance and testing of Enterprise Business Continuity, Disaster Recovery, and Crisis/Incident Management programs. Additional responsibilities include risk, controls and compliance management, supporting BC/DR audit and examination activities, and development & maintenance of policies, standards & procedures that are aligned with the best practices (NIST). Familiarity with fundamental IT concepts, infrastructure & data center technologies is required. This position will require communication and coordination across the organization – the Business Continuity & Disaster Recovery Manager must demonstrate strong communication and stakeholder management skills. The IT Security Architect will use data collected from a variety of Computer Network Defense (CND) tools to include but not limited to IDS alerts, firewall and network traffic logs, and host system logs to analyze events that occur within the UMC environment.. Job Specific Responsibilities Daily assignments may include but are not limited to: • Collect and analyze event information and perform threat or target analysis duties in an effort to identify sources for signs of compromise, unauthorized activity and, poor security practices • Develop threat assessment reports for dissemination to key staff and departments as required. • Assist in developing and leveraging threat intelligence for proactive prevention and detection capabilities. • Monitor network traffic using approved devices to better identify threats and intrusions. • Assist in Incident Response efforts by performing in-depth forensic analysis on computer evidence to determine root cause, attack vector, scope of compromise, attacker capabilities, and so on. • Assist in threat containment, eradication, and recovery procedures. • Review security devices for anomalous activity, identify incidents, and optimize signatures to reduce false positives. • Submit incident reports and present to stakeholders. • Assist in the installation, configuration, and maintaining of network security tools. • Follow industry and department standards to ensure UMC security is consistent with, and/or superior to, industry best practices. • All other related assigned responsibilities

Requirements

Bachelor’s degree + 1 year of relevant experience, preferably in IT healthcare OR
High School Diploma +5 years of relevant work experience
Excellent attention to detail skills
Proficiency in one or more of the following areas: network communication using TCP/IP protocols, basic system administration, basic understanding of malware, knowledge of computer network defense operations (proxy, firewall, IDS/IPS, router/switch)
Ability to perform data analysis, aggregation, event correlation and information security threat definition

Nice To Haves

Experience with SEIM, Forensics and packet capture analysis (Wireshark, tcpdump) is desirable.

Responsibilities

Conduct BIA for assigned Business Units (BUs).
Support review and maintenance of business continuity policy, standards and processes.
Support internal reporting and tracking of business continuity related issues and remediation activities.
Support the identification of Business Continuity related risks (internal / external), the assessment of their likelihood, as well as potential impacts and risk mitigation plans.
Proactively identify and implement BCP program and process improvements.
Provide ongoing SME guidance and assistance to CISO and Cyber Security Council on business continuity matters.
Ensure that IT DR applications have a fully documented, tested, executable plans
Design, coordinate and execute BCP/DR annual test exercises for critical business processes, and produce test reports including lessons learned. Coordinate follow up on lessons as required.
Partner with infrastructure and application areas to develop and maintain recovery procedures for Tier 1 business applications.
Develop recovery priorities, timelines, and strategy for proper sequence of recovery components.
Educate and train IT members in practices of technology risk disaster recovery planning.
Assist Crisis Management / Incident Management teams during service disruption events, and contribute to process improvement initiatives.
Develop, review and maintain third party contracts for hardware and telecom services for Disaster Recovery hardware equipment and location resources.
Follow industry and department standards to ensure UMC security is consistent with, and/or superior to, industry best practices.
All other related assigned responsibilities
Collect and analyze event information and perform threat or target analysis duties in an effort to identify sources for signs of compromise, unauthorized activity and, poor security practices
Develop threat assessment reports for dissemination to key staff and departments as required.
Assist in developing and leveraging threat intelligence for proactive prevention and detection capabilities.
Monitor network traffic using approved devices to better identify threats and intrusions.
Assist in Incident Response efforts by performing in-depth forensic analysis on computer evidence to determine root cause, attack vector, scope of compromise, attacker capabilities, and so on.
Assist in threat containment, eradication, and recovery procedures.
Review security devices for anomalous activity, identify incidents, and optimize signatures to reduce false positives.
Submit incident reports and present to stakeholders.
Assist in the installation, configuration, and maintaining of network security tools.