Security Analyst/Senior Security Analyst (Infrastructure Security) - ITDSGGR (Contractual)

International Monetary Fund•Washington, DC

1d•Onsite

About The Position

The Information Technology Department (ITD) at the IMF is a critical catalyst for change, championing the seamless integration of cutting-edge technology solutions to propel the IMF's mission through innovation and efficiency. The Information Security and Governance (ISG) division and other first-line cybersecurity teams are guardians of integrity and trust, focused on managing risks and envisioning, enabling, and implementing a secure future for global economic stability. The ISG division is seeking to fill a Security Analyst/Senior Security Analyst (Infrastructure Security) position. Under the general supervision of an information security assurance manager, the candidate will provide expertise in the definition, design, engineering, and validation of security configurations for technology platforms in the cloud and on-premises. The role requires collaboration with project teams, service providers, and business units, bringing pragmatic on-premises and cloud security and risk management experience to meet current and emergent business needs. The candidate will advise and influence technology and business personnel on safeguarding information, applications, systems, infrastructure, and activities to ensure optimal technology function and managed information risks.

Requirements

Bachelor's degree in information security, computer science, engineering, mathematics, business, or related field of study plus a minimum of 10 years of relevant experience working in infrastructure or enterprise security roles; OR Advanced degree in Information Security, computer science, engineering, mathematics, business, or related field of study plus a minimum of 4 years of relevant experience working in infrastructure or enterprise security roles.
CISSP or CISM certification (minimum required).
Proven track record in delivering technical security assurance and engineering solutions, with practical implementation experience in operational security within regulated environments.
Extensive technical security experience across a broad range of core Azure services, including Microsoft 365 security controls, Entra ID, Microsoft Defender suite, Azure network security, and other key components of the Microsoft security ecosystem.
Advanced working knowledge (preferably previous hands-on experience) in: Wide array of Infrastructure services e.g. Virtualization Platform, Linux and Windows Operating systems and OS applications, Active Directory and related services, Networking services – switches and routers and other supporting services.
Advanced working knowledge (preferably previous hands-on experience) in: Web Server e.g. Apache and IIS.
Advanced working knowledge (preferably previous hands-on experience) in: Applications e.g. Tomcat and other application servers.
Advanced working knowledge (preferably previous hands-on experience) in: Database system e.g. MSSQL, PgSQL, Oracle, MongoDB etc.
Advanced working knowledge (preferably previous hands-on experience) in: Security technologies e.g. Firewall (Checkpoint, Palo Alto, Azure Firewall), IDS/IPS, Proxy service (forward and reverse), Zero trust, SIEM, SOAR, Network detection and Response (NDR).
Hands-on security configuration of platforms (cloud and non-cloud).
Basic IT consultancy skills.
Demonstrates expertise in securing application, database, and infrastructure components through tailored hardening approaches, employing modern tools and techniques to protect the full technology stack.
Pragmatic security expert with an inherent ability to balance security demands with business reality.
Demonstrates a commitment to continuous learning to stay current with the evolving cybersecurity landscape and to effectively apply security controls that support business goals.
Strong knowledge of security solutions, emerging threats, and effective countermeasures.
Analytical skills that enable synthesis of inputs from many sources and allow for strategic thinking and tactical implementation.
Spoken and written communications that are compelling, convincing, and reassuring, and skills to articulate complex technical ideas to non-technical stakeholders.
Ability to think laterally and to have input to / propose detailed, complex solutions to technical issues.
Interpersonal skills that create openness and trust among colleagues.
Ability to work well under pressure and to meet tight deadlines.
Demonstrates a high level of motivation, confidence, integrity, and responsibility.
Ability to be organized, responsive, and to be able to effectively multi-task with a focus on driving results.
Demonstrate excellent interpersonal and relationship management skills.
Ability to work independently, effectively in a team/task force as a team member or leader, and with senior staff and managers.
Excellent relationship management skills.
Facilitation and conflict management skills that enable effective working relationships.

Nice To Haves

CCSP certification (preferred).
Microsoft Certified: Cybersecurity Architect Expert (preferred).
Microsoft Certified: Azure Solutions Architect Expert (preferred).
Other Microsoft cloud security related certifications at the Expert level (preferred).
GIAC certifications (preferred).
Offensive security related certifications (preferred).
Red Hat Certified Engineer (RHCE®)/ A Red Hat® Certified Architect (RHCA) (preferred).

Responsibilities

Provide cybersecurity assurance expertise for a broad range of IT initiatives, including defining, guiding the engineering, and validating the implementation of technology-agnostic security control standards, technology-specific configuration baselines (Security Hardening), and implementation guidelines for technology platforms (both cloud and on-prem) and services.
Maintain impartiality around IT systems to produce unbiased reports on information security risk.
Conduct quality assurance reviews of security requirements and audit recommendations for the implementation of identified solutions.
Effectively communicate requirements and educate stakeholders in IT divisions on appropriate security design and technical configuration of related controls on IT platforms throughout their lifecycle.
Work closely with IT project teams to develop implementation plans for new security-related products, platforms, and services.
Act as an advocate of information security, working closely and proactively with IT stakeholders, service providers, and business units to provide security-related technical solutions.
Identify opportunities to improve business practices or IT security-related processes.
Prioritize, monitor, and assess compliance and audit recommendation results to ensure they are comprehensive, robust, and of high quality.
Support the information security assurance manager in maintaining the Fund's ISO 27001 certification by promoting self-compliance to policies and standards by IT staff and managers.
Keep abreast of international information security codes of practice such as ISO 27001/27002, information security and privacy regulations and how these measures could affect information assets owned by, or administered on behalf of, the IMF.
Analyze, recommend, and implement process improvements within the context of information security.