Information / Cyber Security (InfoSec)

Join Careers Inc in San Juan, PR to support InfoSec governance, security operations, access administration, and incident response for TCPR, alongside infrastructure and network support with TMCC and HQ coordination.

Responsibilities

• Develop and apply knowledge of business processes, policies, procedures, governance practices, and regulatory requirements
• Ensure processes and technologies comply with TFS Information Security standards (including GISG and TMCC)
• Produce monthly IT Security Department reports of Key Risk Indicators, including vulnerability scores, endpoint compliance, and material incidents
• Provide InfoSec status to the ERMC committee when required
• Identify non-compliance with security standards or controls and submit exceptions for approval
• Report information security activity status and metrics for review with the Information Security Officer (ISO) and the AOR GISG regional representative for TCPR
• Attend AOR InfoSec-GISG/GISS meetings to learn best practices and updated activities, and communicate TCPR-related updates
• Ensure access to information assets is authorized by management and asset owners
• Monitor and regularly review user access through attestation
• Ensure timely provisioning of equipment and access for new hires
• Ensure timely removal of access for terminated users
• Manage required security training and ensure completion of security awareness training for team members and new hires
• Report to the IT Manager the list of team members not in compliance with training and/or failing phishing tests
• Complete continued education requirements (professional courses, certifications, seminars, trainings) aligned with business needs
• Ensure security requirements are addressed across the lifecycle of TCPR assets
• Maintain inventories of information assets, including on-premises/cloud network, servers/workstations, operating systems, applications, and mobile computers/devices, with secure configuration and issuance
• Coordinate with TMCC to ensure network devices, servers, workstations, mobile devices, and other endpoints are protected and monitored for malicious activity
• Identify and track system and application vulnerabilities
• Research and analyze complex vulnerability incidents until resolved to meet compliance metrics, including cross-collaboration for root cause, recommended fixes, and patch application
• Partner with IT and other resources on vulnerability remediation plans (dates, responsibilities), monitor progress, and report updates to the IT Manager
• Provide periodic remedial effort status updates to the TCPR ISO
• Monitor endpoint protection compliance to ensure required weekly metrics for monthly reporting; when issues occur, review, research, and analyze to resolve
• Oversee technological upgrades, security environment improvements, tasks, and major changes
• Support the security infrastructure and technologies established for TCPR
• Conduct logging of network and system activities (users, local applications, and access to physical assets)
• Monitor logs and other sources of information (users, applications, networks, systems, and physical access), analyze suspected malicious activities, and escalate appropriately
• Support yearlong or multi-phase technology and facilities implementations and integrations; provide subject matter ideas and solutions

Incident Response and Management

• Serve on the Security Incident Response Team (SIRT) as a technical SME
• Assist the ISO with incidents across detection, analysis, response, and recovery
• With the ISO, perform tests, exercises, and drills of all response plans
• With the ISO, conduct problem management, root cause analysis, and postmortem reviews after incidents
• With the ISO, support forensic investigations in coordination with law enforcement and other regulatory bodies during and after incidents

Infrastructure and Network Support

• Provide direct technical support to onsite infrastructure managed by TMCC
• Implement infrastructure upgrades led by TMCC by completing prior analysis to ensure operations are not impacted; coordinate proactively
• Complete data room maintenance, including planning and communicating equipment shutdowns without interrupting daily operations; may require work outside scheduled hours/days
• Answer HQ requests regarding potential errors or problems detected in the network, applying expert knowledge to adhere to prevention guidelines and resolve issues

Requirements

• Demonstrated understanding of business processes, policies, procedures, governance practices, and regulatory requirements
• Ability to ensure compliance with TFS Information Security standards (GISG, TMCC, etc.)
• Experience supporting security access administration, attestation, and lifecycle provisioning and removal of access
• Ability to manage security training and report on compliance and phishing test results
• Capability to maintain inventories and support secure configuration and issuance of information assets
• Ability to identify and track vulnerabilities and perform complex vulnerability incident analysis until resolved
• Ability to support endpoint protection compliance monitoring and resolution
• Competence in security logging, log monitoring, malicious activity analysis, and appropriate escalation
• Experience participating in incident response as a technical SME, including drills, problem management, root cause analysis, postmortems, and forensic coordination
• Ability to provide onsite infrastructure technical support and implement upgrades led by TMCC with proactive planning

Location and Salary

• Location: San Juan, PR (onsite)
• Compensation: USD 1 - 2 per hourly