IT Security Engineer

FIRST FIDELITY BANK•Oklahoma City, OK

6d•Onsite

About The Position

The IT Security Engineer supports First Fidelity Bank’s strategic, enterprise-wide Information Security/Cybersecurity Program to protect the Bank’s data, systems, information assets, intellectual property, and reputation. Reporting to the Chief Technology Officer, the role oversees security tools, documentation, standards, and processes to maintain an effective, secure, sustainable, scalable, and compliant operating environment. The position is on-site at the Corporate Office in Oklahoma City, Oklahoma, and provides support for IT projects, risk assessments, audits, regulatory examinations, security awareness, incident response, and the Bank’s disaster recovery and business continuity program. The role may require after-hours and weekend analysis on an as-needed basis. Regular and reliable attendance is required.

Requirements

Bachelor’s degree in computer science, information technology, engineering, business administration, or a related technical field.
3–5 years of combined work experience in networking, infrastructure, or security.
3–5 years of experience with Linux (Debian), Active Directory, and Windows desktop and server operating systems.
3–5 years of experience in host-based security, malware prevention, data loss prevention, digital forensics, and security information and event management systems.
2–3 years of experience implementing and managing firewalls and network intrusion systems, specifically Fortinet products including FortiGate, FortiManager, and FortiAnalyzer.
2–3 years of experience with cloud-based solutions such as Microsoft 365, AWS, and Azure.
2–3 years of experience in vulnerability management for on-premise, cloud, and SaaS-based information systems and enterprise applications.
Knowledge of common security principles, concepts, and methods, including authentication, authorization, single sign-on, network segregation, DMZ, Zero Trust, defense-in-depth, penetration testing, and sandboxing.
Knowledge of cloud-provider security and protection techniques, including security assessments and applying enterprise security strategies.
Understanding of regulations and guidance for banks and financial services organizations, such as FDIC, FFIEC, PCI DSS, GLBA, and SOX.
Effective oral and written communication skills, including the ability to explain security concepts to technical and non-technical staff and bridge IT with business process owners.
Project management aptitude and professionalism in managing multiple projects and resources.
Detail orientation, urgency, and commitment to positive results.
Ability to troubleshoot programs and critically analyze complex problems to find solutions.
Strong work ethic and ability to manage a large workload under tight deadlines.
Excellent organizational skills; ability to work independently, manage multiple tasks, prioritize, and meet project deadlines.
Ability to establish and maintain effective working relationships with executive leadership, peers, managers, vendors, and contractors.
Sound judgment in evaluating situations and making decisions.
Commitment to continual learning and maintaining knowledge of emerging technologies and security controls.
Ability to work well on a team and independently with minimal oversight and direction.

Nice To Haves

Preferred certifications include CISSP, CISM, GSEC, or CISA.
Experience across companies of different sizes, roles, technologies, and products.

Responsibilities

Oversee the management and operation of information security and cybersecurity tools, documentation, standards, and processes in alignment with Bank policies and regulatory requirements.
Provide information and cyber risk guidance for IT projects, including evaluating and recommending technical controls, policies, and procedures.
Monitor information security and cybersecurity developments and trends, and formulate strategy accordingly.
Work with stakeholders to develop business cases for security projects and risk assessments of existing and planned information systems.
Support a proactive security culture aligned with internal policy and regulatory requirements, and collaborate with IT, executive leadership, operations, business lines, risk management, and internal audit.
Prepare and present accurate, timely information for audits and regulatory examinations, and develop effective relationships with internal audit.
Provide mentorship and support to IT team members on information security and cybersecurity matters, including guidance on escalated security incidents.
Provide leadership and technical and administrative support for disaster recovery and business continuity, and implement controls to mitigate identified risks and threats.
Assess potential threats such as phishing, malware, and network attacks, documenting findings and timelines to help determine whether to declare a security incident.
Lead response to security events under the direction of the Chief Technology Officer, using incident-response workflows for triage, analysis, notification, escalation, containment, remediation, and reporting.
Monitor system access, maintain network and system access-control profiles, and track access authorization documentation for IT resources.
Install, modify, enhance, and maintain data-system security software; perform application and network penetration tests and firewall audits.
Support security awareness and the development of controls and detection solutions for malware, cybersecurity, and advanced or persistent attacks.
Support continuous monitoring by reporting Key Risk Indicators (KRIs) and Key Control Indicators (KCIs).
Assist with penetration testing, results analysis, recommendations, remediation planning and implementation, and reporting.
Provide after-hours and weekend analysis as needed outside general working hours.
Perform other duties assigned by the Chief Technology Officer.
Maintain regular and reliable attendance.