Security Engineer

Empower Retirement, LLC is hiring a Security Engineer to support Threat and Vulnerability Management within Cyber Threat and Detection. The role focuses on assessing and managing vulnerabilities, supporting application security across development teams, and driving remediation and security automation.

Responsibilities:

• The Engineer will assist in managing vulnerability assessments and findings; tracking vulnerabilities to remediation, assist in evaluating vulnerabilities for applicability and the level of threat posed; research and investigation of vulnerability alerts; evaluate and report on risks identified through various threat intelligence sources; and perform other duties as assigned
• Conduct application vulnerability assessments
• Administer vulnerability scanning infrastructure
• Manage the security vulnerabilities and risks including identifying, supporting application/system owners to manage risks and remediate vulnerabilities
• Support the Application Security Management program across multiple, agile software development teams
• Assess applications for design-related security risks and assist teams in determining appropriate remediation for issues identified
• Ensure security requirements and best practice standards are implemented and adhered to across the program
• Implement and maintain security automation across TVM space
• Drive implementation of threat and vulnerability management tools
• Provide technical analysis of vulnerabilities identified (through scanning, threat intelligence, research, and vendor notifications) to determine their impact, help prioritize, communicate to the relevant partners, and drive an overall timely remediation based on agreed upon internal program governance
• Develop effective strategies for vulnerability remediation and bring to bear technology to orchestrate and automate (where possible)
• Develop skills, technical capabilities, and methods to deliver the best cyber defense capability to protect IT assets from cyber threats, attacks, and exploitation
• Maintain situational awareness of meaningful cyber defense initiatives, indicator lists, threat reports, incident response techniques, and cyber defense technologies to ensure that cyber defenses are effective and incorporating the best protections
• Supports other areas within TVM

Requirements:

• Applicants must be authorized to work for any employer in the U.S. We are unable to sponsor or take over sponsorship of an employment visa at this time, including CPT/OPT
• The ability to prioritize, work under deadline, and provide excellent customer service to users will be key qualities
• The right individual is detail-oriented, has a technical curiosity and desire to learn, and has solid communication skills to effectively understand the problem areas and escalate where needed
• The ability to provide clear instruction to internal customers
• Effective team collaboration and communication are critical in this role
• A degree or industry-recognized certification in intelligence or cybersecurity, or equivalent experience
• Three years work experience in IT and two years of experience in Cybersecurity and/or Application Security
• Ability to perform and manage network vulnerability testing, penetration testing and/or threat assessments
• Understanding of Cloud Infrastructure and Cloud Security
• Demonstrates understanding of most of the following: Linux/Windows server and application administration, configuration, networking, scripting and automation, large scale distributed computing architecture (client server, cloud, intranet/internet), hardware/operating system/application interaction, and security
• Ability to interpret information security data and processes to identify risk and security threats
• Strong analytical, technical, and problem solving skills
• Comfortable speaking technically with analysts and strategically with senior executives
• Strong presentation and interpersonal skills
• Able to manage competing priorities and work efficiently under pressure
• Have the ability to organize, plan, prioritize and complete assignments with minimal supervision
• Knowledge of key best practices, compliance standards or frameworks such as OWASP Top 10, NIST, and SANS Top 20
• Coding experience a plus
• Holder of key industry certifications such as CISSP, GIAC certification(s)