SR. Security Engineer- Governance and Compliance

University of Phoenix is seeking a Senior Security Engineer focused on governance and compliance. The role leads the implementation and configuration of security tools, develops security standards and governance programs, assesses and remediates risks, and supports cloud and Identity and Access Management environments, incident response, audits, and regulatory compliance.

Responsibilities:

• Lead efforts to implement and configure security tools within the University’s technology space to protect its information assets, including customer assets; collaborate with information security peers and management to ensure various platforms, such as Azure, AWS, Private cloud, SaaS applications, are compliant and meet the University’s information security standards and regulatory requirements
• Monitor and recommend changes in strategies and standards that affect Information Security, especially in the area of privacy and identity theft; proactively assess potential items of risk and vulnerabilities in cloud technologies and applications or IAM; establish and provide security governance during the systems development lifecycle, construction, and maintenance of cloud or IAM technologies and solutions using DevOps, DevSecOps, and Agile development methodologies
• Identify opportunities to improve risk posture, develop solutions for remediating or mitigating risks and assessing the residual risk. Communicates risk findings to Information Security customers and business partners; develop remediation plans and coordinate with appropriate service, application, and technology owners through the completion of those plans, as appropriate
• Evaluate existing Information Security standards and updates according to technology advances, changes in business process and threat landscape; adjust existing Information Security standards to align with leading cloud and/or IAM security practices and technologies
• Hands-on experience with designing, implementing, and managing IAM and/or cloud solutions while overseeing user access provisioning, deprovisioning and role-based access controls (RBAC)
• Maintain detailed working knowledge and awareness of concepts within the following: Identity & Access Management (IAM), Access Controls, Authorization, Encryption of data at rest / in transit, multi-factor authentication, SAML, Single-Sign-On, Social Sign On, web application firewalls, etc
• Work collaboratively across cross-functional teams to integrate IAM and/or cloud solutions and services; maintaining runbooks for cloud and/or IAM workflows and processes
• Able to provide support after normal business hours, as needed
• Perform other duties as assigned or apparent

Requirements:

• • Bachelor's degree in Computer Science, Business, or related area
• • Ten (10) years of progressive experience in Information Security related roles with at least Six (6) years of hands-on experience
• • Security related certifications e.g., CISSP, CISM, CISA
• • Ability to align compliance regulations (SOX, GLBA, etc.)
• • Experience with being an audit liaison and support
• • Experience with controls documentation and accuracy
• • Experience with vendor management
• • Experience with legal contract support
• • Experience with simplified artifacts retrieval
• • Ability to QA process for validation of evidence before providing
• • Cybersecurity Insurance
• • Experience with automation of evidence collection and process
• • Able to provide support after normal business hours as needed
• • Industry recognized certifications specific to IAM (e.g. Certified Identity and Access Manager, Identity and Access Administrator Associate, etc.)
• • Working knowledge of industry frameworks related to information security (e.g. ISO 27000, NIST, etc.)
• • Experienced in network and Security components, including firewalls, intrusion detection systems, anti-malware products, e-Discovery and forensics tools and products, IT Risk Management methodologies, data encryption, VPN's, vulnerability scanners, multiple operating systems (Windows, UNIX, Linux, etc.), cloud security groups, and directory services (Active Directory, LDAP)
• • Subject Matter Expert (SME) level knowledge of security tools, trends, methodologies, and best practices for securing platforms and operating systems at the server, client, and handheld level
• • Expert knowledge of information security risks and countermeasures for Windows, Unix/Linux platforms and cloud environments
• • Experience with principal and policy-based security design methodologies with understanding of IaaS, PaaS, and SaaS models
• • Able to create and manage Security solutions with a high degree of integration
• • Strong understanding of regulatory requirements (PCI, SOX, GLBA) and how they impact information security functions
• • Demonstrated ability to work effectively in a collaborative team environment as an individual contributor
• • Strong business analysis skills
• • Able to learn quickly, absorb and retain information, and apply knowledge when and where relevant
• • Self-motivated and able to work on own initiative with minimal guidance and a desire to see tasks through to completion
• • Experience managing a varied and heavy workload