Lead Information Security Engineer - Phishing Mitigation

Wells Fargo Bank•San Francisco, CA

About The Position

Wells Fargo is seeking a Lead Information Security Engineer in Technology as part of Cybersecurity. Learn more about the career areas and lines of business at wellsfargojobs.com. The ideal candidate will have a well-rounded background in incident response, threat detection, phishing, and cybercrime. The ideal candidate will have experience in conducting research and identifying methods to detect emerging cyber threats, attack methods, and evolving Tactics, Techniques, and Procedures (TTPs) with an emphasis on phishing and/or cybercrime. The candidate should have some experience with data analytic techniques, including machine learning, statistics and data mining to solve core business challenges. Additionally, the candidate should have a solid understanding of endpoint/network defenses and security incident response. Regular collaboration with multiple teams such as the Cyber Threat Fusion Center, Security Content Development, Cyber Threat Intelligence, Cyber Threat Forensics, and Offensive Security teams will be critical to success. Strong verbal and written communication skills are desired, in order to ensure thorough and accurate reporting during and concluding a security incident. The candidate will also play a major role in our phishing disruption efforts, including creation of new logic and procedures to identify phishing attacks impacting Wells Fargo customers and employees.

Requirements

5+ years of Information Security Engineering experience, or equivalent demonstrated through one or a combination of the following: work experience, training, military experience, education
3+ years of experience in one or more of the following security disciplines: information security monitoring, incident response, vulnerability management, host/network forensics, cyber-crime investigation, penetration testing, business continuity, or cyber threat intelligence
3+ years of information technology applications and systems experience
3+ years of technical documentation and publication experience
1+ year of Splunk experience

Nice To Haves

Experience resolving and working through escalated and complex issues
Experience overseeing development of counter-measure strategies and tactics to offset emerging and evolving external threats from malware/viruses, phishing, pharming and other social engineering schemes
Ability to execute in a fast paced, high demand, environment while balancing multiple priorities
3+ years of malware reverse engineering experience
Experience working in a large enterprise environment
Knowledge and understanding of financial crimes investigation
Knowledge and understanding of banking or financial services industry
3+ years of experience managing cybercrime detection, investigation, and intelligence strategies
Hands-on experience with information security tools such as an enterprise SIEM solution, IDS/IPS, endpoint security solutions, email/web security gateways, and other security detection/mitigation devices
Experience with host and/or network log analysis as applied to incident response / threat hunting
Knowledge of offensive security, with the ability to think like an adversary when hunting and responding to incidents
Strong ability to identify anomalous behavior on endpoint devices and/or network communications
Strong experience in operating system and application security hardening and best practices
Strong investigative mindset with an attention to detail
Experience with multiple operating systems to include Windows, Mac OS, and Unix/Linux
Advanced problem solving skills, ability to develop effective long-term solutions to complex problems
Certifications in one or more of the following: Certified Information Systems Security Professional (CISSP), GIAC Certified Incident Handler (GCIH), GIAC Reverse Engineering Malware (GREM), GIAC Certified Forensic Analyst (GCFA), GIAC Network Forensics Analyst (GNFA), Offensive Security (OSCP/OSCE/etc), or other relevant certifications.

Responsibilities

Lead or participate in computer security incident response activities for moderately complex events
Conduct technical investigation of security related incidents and post incident digital forensics to identify causes and recommend future mitigation strategies
Provide security consulting on medium projects for internal clients to ensure conformity with corporate information, security policy, and standards
Design, document, test, maintain, and provide issue resolution recommendations for moderately complex security solutions related to networking, cryptography, cloud, authentication and directory services, email, internet, applications, and endpoint security
Review and correlate security logs
Utilize subject matter knowledge in industry leading security solutions and best practices to implement one or more components of information security such as availability, integrity, confidentiality, risk management, threat identification, modeling, monitoring, incident response, access management, and business continuity
Identify security vulnerabilities and issues, perform risk assessments, and evaluate remediation alternatives
Collaborate and consult with peers, colleagues and managers to resolve issues and achieve goals
Lead a team to achieve objectives