Sr IT Security Engineer

The American Medical Association (AMA) is a professional association and nonprofit organization representing physicians and supporting improvements in public health. The Senior IT Security Engineer will support security and cyber threat intelligence, threat detection and response, security platform administration, and the protection of cloud-based and on-premise applications. The role will also develop security programs, manage security operations, and collaborate with IT engineering and infrastructure teams.

Responsibilities:

• Research, design and advocate new technologies, architectures, and security products that will support security requirements for the enterprise and its customers, business partners, and vendors
• Plan, document, and execute enterprise-wide security programs, including vulnerability identification and testing, network scanning framework for public and private networks and other technologies
• Configure and troubleshoot vulnerability assessment tools and endpoint solutions; perform scans, and identify and research threats; summarize results and corrective actions where appropriate
• Consult with IT, compliance, audit, and others to ensure development, implementation, and administration of applications and infrastructure meets standards for IT security and regulatory audit compliance
• Communicate IT Security policies and procedures to management and end users across businesses
• Collect and analyze defined metrics to report to leadership, including security dashboards and results of trainings
• Develop and/or deliver information security awareness training, including phishing simulations and risk-based training content for high-risk users
• Identify, collect, and organize credible, new intelligence and subject matter relative to current and emerging threats using all the tools, applications and open-source information
• Define and document, application security standards for developers; ensure compliance with applicable security controls when writing such standards
• Design, lead, and project manage the development and configuration of security tools and automation based on use cases
• Proactively monitor, analyze, block, and respond to malware and other emerging threats; serve as technical point of contact during and after security incidents including digital forensics procedures
• Conduct operational threat hunting exercises to proactively find incidents in the AMA environment
• Perform threat modeling and risk assessments using standard security frameworks for cloud services
• Monitor and audit networks, on-premise and cloud systems and service changes
• Document incident response procedures; support management communication during incidents
• Assist in management of security services providers
• Responsible for researching new threats, attacks, and risks to infrastructure and software
• Define and document operating procedures for incident identification, investigation, and response
• Work with businesses to identify and address data security risks in business processes
• Analyze and make recommendations to enhance our security posture within cloud and hybrid environments and associated services and configurations
• Improve security reporting, including coordinating vulnerability management, penetration testing, and infrastructure compliance
• Create or update of detailed operational processes and procedures related to security operations, incident management & code development
• May include other responsibilities as assigned

Requirements:

• 1. Bachelor's degree required in Information Security, Engineering, Computer Science, or related field
• 1. Demonstrated progression towards one or more security of the following certifications; GIAC Certified Incident Handler (GCIH), GIAC Certified Intrusion Analyst (GCIA), CISSP/CISA certification, CISM
• 1. 5+ years of Security Operations experience is required, including cyber incident investigations
• 1. Strong understanding of various network and host-based security applications and host-based security applications and tools
• 1. Exposure to enterprise web application programming and Application Security (AppSec)
• 1. Knowledge of browser security controls, web application security frameworks, and authentication infrastructures (SAML, OAUTH), technical infrastructure, end points, networks, databases, and systems in relation to IT Security and IT Risk
• 1. Understanding of cloud networking concepts and architecture to promote and develop new designs and security strategies across all types of cloud-based applications (including infrastructure, platform, and software as a service)
• 1. Excellent written and verbal communication skills; able to communicate technical concepts to business leaders and users clearly, with appropriate emphasis on urgency and priority of potential threats and possible security incidents in progress
• 1. Ability to respond to security incidents promptly and independently, addressing incidents under time pressure
• 1. Excellent analytical, organizational and communication skills; demonstrated ability to facilitate cross-functional teams
• 1. Experience in continuous improvements and agile methodology