IT Security Engineer

Atmos Energy•Dallas, TX

11d•Onsite

About The Position

This role involves managing SIEM, performing incident analysis, and advising on security measures. The IT Security Engineer will identify, report, and resolve security incidents, compose security alert notifications, and deploy/maintain security controls. A key aspect of the role is staying updated on IT security trends, external threats, and vulnerabilities. The position also involves developing reports, automating triage tasks through scripting, and acting as an interface between users and IT operations. Participation in planning and executing contracted security services is also required.

Requirements

Bachelor's degree in Computer Science or a closely related field and four years related experience in Information Security, or equivalent.
Experience on a computer incident response Team (CIRT), computer emergency response team (CERT), computer security incident response center (CSIRC) or a security operations center (SOC).
Experience with anti-virus, intrusion detection systems, firewalls, active directory, vulnerability assessment tools and other security tools found in large network environments; along with experience working with security information and event management (SIEM) solutions.
Experience with vulnerability management, log management, analysis, and monitoring, virtual private networks, virtualization, firewalls, web application security concepts and intrusion detection/prevention systems.
Shell scripting experience with unix tools (sed, awk, grep, etc) and Python
Experience with syslog technologies (e.g., syslog-ng, rsyslog, Snare and SIEM technologies).
Strong technical background in operating systems (UNIX/Linux, Windows), internet applications (electronic mail, web, DNS/DHCP, TCP/IP), desktop software (Microsoft Office, virus detection programs), encryption (SSL, TLS, IPSEC) and networking hardware and software.
Understanding of protocols and standards such as TCP/IP, LDAP and 802.1x and network management tools such as SNMP, and NIST.
Knowledge of local and federal law enforcement practices, procedures, and evidential chain of custody, as related to IT security incidents.
Strong knowledge of network PCAP analysis tools (ex, WireShark).
Knowledge of LogRhythm or compairable SIEM technologies.
Understanding of the Lockheed kill chain and analysis of each stage.
Experience with Forensics tools such as Volatility, Encase, etc
Ability to communicate effectively and the skills to inform, persuade and/or influence internal and/or external customers and senior management on matters of a technical and/or complex nature.
Ability to perform analyses involving ratios, percentages and simple statistical methods.

Nice To Haves

Knowledge of PCI compliance and performing triage within a PCI environment is a plus.
Professional security certification (i.e., CEH, CISSP, ISSP, SSCP, GIAC, etc.).
Experience within the Department of Homeland Security or other government agencies.
Experience with digital media analysis (DMA) and computer forensics.
Background in utility scripting and programming (Python, Powershell and Bash) and network operations.

Responsibilities

Manages SIEM and performs analyses of incidents from multiple sources for severity and risk.
Performs network traffic and log analyses.
Performs configuration and administration of the SIEM environment including installation of new agents, configuration of alerts and rules, reporting, and overall health of the system.
Exercises independent thinking to prioritize and differentiate between potential intrusion attempts and false alarms.
Advises incident responders in the steps to investigate and resolve computer security incidents.
Identifies, reports and resolves security incidents.
Determines appropriate resources needed to resolve incidents and works with resources to identify malicious activity.
Creates and tracks investigations through resolution.
Composes security alert notifications.
Deploys and maintains security controls within the network environment to help prevent and detect security events.
Maintains up-to-date knowledge of information technology related trends, external threats, current vulnerabilities, attacks, and countermeasures.
Develops periodic reporting and trend analysis of identified issues and aides in tuning to reduce false positives.
Collects and tracks incident metrics related to IT security.
Writes and implements programs and routines in various scripting languages to improve and automate security triage tasks.
Acts as secondary interface between users and IT engineering and security operations.
Participates in the planning and execution of contracted services with outside vendors (e.g., security monitoring and analytical services).