Associate Director, Information Security Engineer

How you’ll help protect PPFA

The Security Engineer manages Information Technology security protections with the goal of protecting PPFA from security incidents and reducing the impact of system compromises. You will deliver this through 24x7 monitoring, investigations, and countermeasure recommendations, with a focus on SIEM architecture and operational effectiveness.

Responsibilities

• Provide security monitoring, event investigation and analysis, and countermeasure proposals on a 24x7 basis.
• Support and guide Tier I Analysts, and provide technical assistance for Tier II and Tier III incidents as assigned.
• Interface with the InfoSec Operations Team, MSSP, and IT Managed Service Provider (MSP) on SIEM security event architecture, collection, management, reporting, and alerting.
• Identify, implement, and maintain Information Security toolsets, primarily focused on SIEM.
• Partner with IT Ops to ensure proper security event logging setup.
• Support Information Security SIEM management needs of PPFA and Affiliates, where applicable.
• Act as a Subject Matter Expert for PPFA’s SIEM (currently Splunk), including the ability to configure, manage, operate, and administer the platform from a managed SIEM perspective.
• Monitor and ensure established processes are followed for event identification, including recommendations for event filtering updates and ensuring those updates are completed.
• Ensure processes are followed for collecting relevant data and performing required levels of analysis.
• Ensure events are assigned appropriately and follow the established process for Tier II escalations, including identifying whether escalation is from MSSP, MSP, Affiliate, or other sources and using the appropriate triage and documentation processes.
• Create and maintain Standard Operating Procedures (SOPs) for the Information Security Ops group and recommend security process improvements.
• Support complex, tool-specific tasks with guidance from management and vendor/MSSP resources.
• Assist in vulnerability assessments setup, scanning, analysis, and remediations, working with IT Ops staff and corporate vendors to correct errors and alerts in IT infrastructure systems.
• Assist in IR incidents as assigned by management.
• Perform all other duties as assigned.

What you bring

• Bachelor’s degree and 5+ years of industry experience.
• Independent decision-making ability, especially for analysis tracks for escalated events and escalation decisions that may range from Tier I events through Incident Response-level remediations.
• Experience with compliance requirements and industry standards including PCI, HIPAA, ISO 27001, NIST, CSF, MITRE ATT&CK, ITIL, COBIT, Sarbanes-Oxley, and SANS 20.
• Experience with UNIX, AIX & Solaris, Linux, and Windows Server.
• Experience with Network/System Intrusion Detection or Prevention Systems (IDS/IPS).
• Experience with SIEM, including Splunk.
• Experience with vulnerability scanner and penetration testing systems.
• Knowledge of wireless networking and switches/routers, plus basic configuration of firewalls.
• Understanding of TCP/IP networking, VPN, VLAN, NAT, and related security concepts.
• Experience with software & hardware asset management.
• Ability to evaluate security threats and implement attack countermeasures.
• Experience conducting forensic analytical studies and investigations.
• Flexibility to adapt quickly to changing priorities and ambiguous situations.
• A deep commitment to Planned Parenthood’s mission of promoting Sexual and Reproductive Health.

Technologies you’ll work with

• Splunk, SIEM
• UNIX, AIX, Solaris, Linux, Windows Server
• IDS/IPS
• Vulnerability scanner, Penetration testing systems
• Wireless Networking
• Switches/Routers, Firewalls (basic configuration)
• TCP/IP, VPN, VLAN, NAT
• MITRE ATT&CK, PCI, HIPAA, ISO 27001, NIST, CSF, ITIL, COBIT, Sarbanes-Oxley, SANS 20