Security Engineer

National Geographic Society•Washington, DC

2h•Hybrid

About The Position

The Technology Division creates digital experiences for and delivers information technology services to the National Geographic Society. From our staff to our constituents, Technology provides the power to amplify National Geographic’s impact through value-based product delivery, transformational data services, and world-class support and infrastructure services. These services include employee training and technical support, audio/visual production, device management, enterprise architecture, network management, on-premise and cloud computing, information security, identity management, data management and integration, product management, user experience design, software development, systems engineering, and systems administration. Technology comprises five teams: Business Products, Constituent Products, Data Products, Infrastructure & Security, and Technology Support Services. The Security Engineer is responsible for the confidentiality, integrity, and availability of all systems owned or operated by the National Geographic Society. These responsibilities include Firewall/IDS/IPS, VPN, SIEM, antivirus/malware, SAST, DAST, vulnerability management, encryption, DLP, compliance, and cloud security in SaaS/PaaS/IaaS environments. Coordinates activities of managed security providers and cloud-based services, including threat intelligence, cloud application monitoring, and incident response. Additional responsibilities include management of technical controls for compliance programs such as PCI-DSS and GDPR including routine environment audits, gap analysis and remediation, process documentation, and submission of completed documents to appropriate regulatory oversight organizations. Works closely with DevSecOps and DataOps teams on secure application, workflow design, and testing/hardening existing systems via penetration test exercises. This position reports to the Senior Director, Infrastructure & Security

Requirements

Bachelor’s degree in Computer Science or related discipline, or equivalent experience.
Minimum of three years of experience with security administration as well as the implementation of appropriate data/host-based security layers within a heterogeneous computing environment.
Comfortable working in cloud-first / consumerized technology environments and integrating into enterprise security programs.
Background with Linux and open-source tools, as well as active security community participation.
Strong experience with securing Amazon Web Services and Google Cloud Platform.
Solid experience with securing endpoint devices including Windows, Mac OS X, Chrome, iOS, Android as well as IoT, with road knowledge of secure website code development/deployment including OWASP best practices, web SDLC and static/dynamic code scanning, data masking/obfuscation/tokenization, API, and encryption key handling.
Basic development or scripting experience and skills.
Ability to excel in a dynamic environment subject to changes in schedules and priorities while participating in multiple projects concurrently from inception to completion with limited management supervision.
Excellent oral and written communication skills in addition to interacting positively and productively with teams across organizational lines with exceptional customer service, troubleshooting and problem solving skills.
Familiarity with industry security practices, standards, and regulations such as ISO27001 and NIST.

Responsibilities

Applications Security (40%): Implementation and management of on-premise and cloud/SaaS application security including application patching and hardening, access control and identity management, security assessments, and audits. Understanding industry best practices with OWASP top 10 Involved in risk and security assessments of new and existing applications developed by internal teams, third parties, or COTS providers. Participation with product teams to understand desired application capabilities and testing scenarios, in addition to perform regular DAST and SAST scans. Report and track results to the appropriate dev-ops or Product team.
Vulnerability Management & Incident Response (30%): Administration and engineering of vulnerability management programs including scanning, patching/remediation, and penetration testing. Experience using assessment tools such as Burp, ZAP, Synk, and using Python scripting, ad-hoc computer emergency response and incident response teams, including tabletop exercises and disaster recovery testing.
Infrastructure Security (20%): Administration and engineering of all network security hardware and software including firewalls, intrusion detection/prevention, information/event log management/analysis, antivirus/malware, and access control. Testing and screening security software and monitoring networks and systems for security breaches or intrusions, system performance analysis, system instrumentation/management, and change management activities.
Privacy/Audit/Compliance (10%): Engineering and management of encryption programs at both hardware and data layers including hard disk encryption, database/file/message encryption, key management, PKI, and certificate management. Management of regulatory compliance programs including PCI-DSS, GDPR, all routine and ad-hoc activities related to system and data integrity.

Benefits

medical, dental, and vision insurance
engaging and comprehensive wellness program
401(k) retirement savings plan with matching contributions after 6 months of employment
flexible paid time off benefits with up to 22 days of paid annual leave per calendar year (15 days for new hires in their first year, prorated based on the number of pay periods remaining in the year) and 10 days of sick leave
12 paid holidays and a paid winter break between December 25 and 31 (May not apply to all roles that are required to work during high volume seasons or essential workers. Please check with the hiring manager for confirmation.)
paid parental leave, adoption and surrogacy expense reimbursement, fertility benefits
learning and development opportunities
Lifestyle Spending Account
pet adoption assistance and insurance
pre-tax transportation benefits with a generous employer subsidy
employer-paid life insurance and disability benefit
a variety of National Geographic discounts and perks