Title: Senior Security Engineer
Location: Bethesda, MD
Permanent Opportunity/Direct Hire
The Sr Security Engineer is responsible for information security guidance during the design and implementation of solutions and services across the business and IT support areas, driving the successful configuration and implementation of IT/Security solutions to reduce risk to an acceptable level for the company. Duties will include, but are not limited to, providing support to internal and external teams to define and develop secure architecture and solutions for projects and business solutions, conduct discovery sessions to gain the necessary background and review findings to ensure sustained compliance, remediation of control gaps, and escalation of possible critical issues to senior management.
The Senior Security Engineer needs to have a strong security background with hands on knowledge on the various security tools required to protect the enterprise. Additional responsibilities include working with various project owners in implementing, executing, and monitoring IT related logical access and IT operations.
• Determines security requirements by evaluating business goals and requirements, conducting system security and vulnerability analyses and risk assessments, studying architecture/platform, identifying integration issues, and preparing cost estimates. Plans delivery of solutions and addresses technical and procedural questions for less experienced team members
• Follows emerging security practices and standards and maintains security by monitoring and ensuring compliance to standards, policies, and procedures such as NIST 800-53, PCI and ISO27001; conducting incident response analyses; develops and conducts training.
• Implements security systems by specifying intrusion detection methodologies and equipment; directing equipment and software installation and calibration; preparing preventive and reactive measures; creating, transmitting, providing technical support; completing documentation.
• Serves as primary technical lead and technical mentor for the Information Security team.
• Performs OS hardening reviews (Windows/Linux/UNIX) and recommendations; as well secure coding reviews of in-house applications written in programming languages such as Objective-C (Apple iOS) and Java (Android) and reviews Cisco Catalyst switch, Cisco Nexus router, and WatchGuard firewall configurations
• Evaluates security of cloud-hosted solutions, such as applications residing in Amazon Web Services (AWS) or Microsoft Azure cloud environments.
Minimum Qualifications, Knowledge, Skills, and Work Environment :
• Requires a Bachelor's degree in Cyber Security, Computer Science or related field experience.
• Requires 10 years of experience in an Information Security role.
• Requires one or more of the following: (ISC) 2 (CISSP), ISACA (CISM) or SANS GIAC Certification (GSEC, GCIH).
• Advanced knowledge of network security infrastructure, risk analysis, data/voice communication systems, services and system/network configurations. Network operations, design, and systems management
• Strong security product knowledge and conceptual understanding of current technologies such as firewalls, VPNs, IDSs and other security devices.
• Requires experience breaking down complex systems and applications to find flaws.
• Requires familiarity with common vulnerabilities (e.g. OWASP Top 10) and attack vectors
• Requires a working knowledge of common enterprise Linux distributions such as (CentOS) and Red Hat Enterprise Linux (RHEL) with SELinux and automation tools.
• Requires working knowledge of the OSI model for computer networks, network operation, and common network protocols such as TCP/IP, 802.1q VLANs, Port Security, EIGRP, BGP, etc.
• Requires working knowledge of information security solutions; e.g., vulnerability management (Rapid7 Nexpose, Tenable Nessus), IDS/IPS (Sourcefire Snort, Bricata), log management (using Syslog, Splunk Enterprise Security, or QRadar SIEM) and all security controls in scope for both PCI compliance and general information security.
• Understanding of enterprise networks impact on application design and performance, scripting and full scale system implementation on UNIX / Windows platforms
• Requires knowledge and experience with PCI, HIPAA, NIST guidelines and emerging Personal Information Privacy Laws.
• Requires strong knowledge of security as applied to virtualized infrastructure including VMware vSphere ESXi hypervisor, Citrix Xen / XenServer.
• Requires experience with common Information Security tools such as Backtrack, Kali Linux, Metasploit, Wireshark, Nmap, THC Hydra, etc.
• Requires excellent communication skills, ability to multitask and complete assigned projects with minimal oversight
• Requires a track record of building collaborative partnerships with team, customers, client stake-holders while setting and managing expectations and acting as department liaison
location: Bethesda, Maryland
job type: Permanent
salary: $135,000 - 142,000 per year
Equal Opportunity Employer: Race, Color, Religion, Sex, Sexual Orientation, Gender Identity, National Origin, Age, Genetic Information, Disability, Protected Veteran Status, or any other legally protected group status.