Senior Cybersecurity Engineer - SRCSENGG 1022 SPS#01

JOB TITLE: Senior Cybersecurity Engineer

JOB OVERVIEW

Department: Information Technology
Reports to: Cybersecurity Office Manager, OT Infrastructure Safety
Location: New York, NY 10004
Hours: 9:00 AM – 5:30 PM (7.5 hours per day) or as required

JOB SUMMARY

This position provides technical expertise in managing and analyzing cybersecurity risks. The engineer designs, builds and maintains the infrastructure and application technology that supports a secure cybersecurity posture. This includes systems that directly support cybersecurity and systems that support business operations across Information Technology and Operational Technology.

Building and configuring systems securely from the outset reduces organizational risk. These systems include applications, infrastructure, wireless, carrier systems, cloud, operational technology and IoT. Specialized skills across technology domains help reduce overall risk. Configuration, hardening, guidance, response and analysis of these systems reduce and contain cybersecurity risk.

The work involves risk assessments, data analytics tools, operational process reviews, and collaboration with security engineers, architects, developers, vendors and business units to continually improve security. The position has seven levels, including an internship level, based on progressive experience, accomplishments, responsibilities and/or education. Depending on level, the engineer may perform all or some of the responsibilities below.

RESPONSIBILITIES

Threat Research and Analysis

• Research emerging threats and vulnerabilities to help identify network incidents and support new architecture, policies, standards and guidance.
• Monitor relevant information sources to stay current on attacks and trends.
• Monitor threat intelligence feeds to identify threats, including indicators of compromise and advanced persistent threats (APTs).
• Identify the tactics, techniques and procedures (TTPs) of potential threats using MITRE ATT&CK or similar frameworks.
• Hypothesize new threats and indicators of compromise.
• Analyze the potential impact of new threats and communicate risks to detection analysts, architects, technology subject matter experts and management.
• Use judgment to form conclusions that may challenge conventional wisdom.

Secure Design, Configuration and Hardening

• Apply secure system configuration and hardening standards in practice.
• Design, configure and integrate secure solutions in the assigned technology domains.
• Install, configure, harden and optimize infrastructure, application and security components and systems, such as:
  • Servers, workstations and mobile devices
  • Directory services, operating systems and middleware
  • IoT devices
  • Web and next-generation firewalls
  • Machine and human behavior learning tools
  • Host-based security systems
  • Security event and incident monitoring systems
  • Virtual, physical and cloud platforms
• Identify configuration gaps independently and/or with vendors to reduce cybersecurity risk.
• Test new systems, and manage cybersecurity risks and remediation, system testing, baselines and best practices.

Incident Response

• Respond to computer security incidents according to the incident response policy and procedures.
• Provide incident response support, including mitigating actions to contain activity, facilitating forensic analysis, system hardening and recovery when necessary.
• Provide technical guidance to first responders handling information security incidents.
• Review alerts and sensor data, and document formal technical incident reports.
• Perform root-cause analysis, document findings and take part in root-cause elimination as required.
• Validate and maintain incident response plans and processes to address potential threats.

Reporting and Communication

• Provide timely, relevant updates to stakeholders and decision makers.
• Communicate investigation findings to business units to help improve the security posture.
• Compile and analyze data for management reporting and metrics.

Policy and Documentation

• Take part in creating enterprise security documents (policies, standards, baselines, guidelines and procedures) under the direction of the IT Security Manager, where appropriate.

Contractor Oversight (as applicable)

• Observe the work performed by contractors.
• Review invoices and approve them if the work meets contractual standards.
• Address performance issues with contractors when possible.
• Escalate issues to other parties when needed.

General

• Perform other duties as assigned.
• Comply with all policies and standards.
• Work hours outside regular hours when required.

QUALIFICATIONS

• Bachelor’s degree in Arts or Sciences (BA/BS). A combination of education and experience may be considered in lieu of a degree.
• Minimum of 10 years of relevant technology-based or cybersecurity experience, or experience in a specific cybersecurity subdomain (cloud, applications, infrastructure, security technology, etc.).
• Minimum of 5 years of experience, as stated in the original posting.
• At least two professional certifications in the subject domain. Examples include, but are not limited to:
  • Certified Information Systems Security Professional (CISSP)
  • Global Information Assurance Certification (GIAC)
  • Certified Information Security Manager (CISM)
  • Certified in Risk and Information Systems Control (CRISC)
  • Certified Information Systems Auditor (CISA)
  • Other related certifications

REQUIRED KNOWLEDGE, SKILLS AND ABILITIES

Core Technical Expertise

• Significant practical expertise in cybersecurity-related disciplines.
• Seasoned expertise in multiple security domains and technologies.
• Strong understanding of current and future technology and security architecture, including the interoperability of security solutions.
• Proven track record of implementing architectural designs.
• Proven track record in configuring and hardening systems.
• Expert ability to conduct and analyze security risk assessments.
• Expert understanding of TCP/IP (OSI Layers 1–4) and Internet and intranet technologies (OSI Layers 5–7).
• Scripting or programming skills (Perl, Python, PowerShell, etc.) are preferred as needed.
• Practical knowledge of secure system configuration and hardening standards.
• Skill in all the threat research, secure design, incident response, reporting and documentation activities listed under Responsibilities.

Proactive Security and Technical Leadership

• Take a proactive approach to cybersecurity while also investigating security incidents related to cybersecurity.
• Act as a technical resource for multiple technologies, with deep knowledge of their capabilities and constraints, to improve system effectiveness and efficiency.
• Provide guidance and training to the IT community to share learning.
• Analyze cross-technology and cross-platform issues, factoring in current and future architectures to ensure performance and reliability.
• Establish systems to monitor compliance with architectural standards and ensure technical integrity.

Technology Evaluation and Planning

• Lead the evaluation of new technologies in the assigned domains to determine how well they meet the needs of the organization and its affiliated agencies.
• Propose technology investments supported by technical analysis and a business case.
• Develop disaster recovery and contingency plans for the assigned domains to minimize service interruptions.

Vendor and Procurement Management

• Create complete RFPs and RFIs.
• Negotiate contract terms and conditions with vendors and procurement, considering business needs.
• Work with major providers at the technical expert level to resolve mission-critical issues.
• Evaluate ongoing vendor service levels and enforce SLAs and penalties.

CRITICAL SKILLS

• Serve as a multi-technology technical authority with expert knowledge of OT, security architecture and cross-system interoperability.
• Shape long-term technology strategy, ensuring secure integration of enterprise and operational systems.
• Provide specialized guidance, mentorship and training across the IT and OT security community.
• Evaluate emerging technologies, identifying applicability, operational risks and strategic impact, and develop technical business cases for investment.
• Develop domain-specific disaster recovery and resilience strategies to minimize service interruptions.
• Author comprehensive technical procurement documents (RFPs/RFIs) and lead contract discussions with vendors and procurement teams.
• Engage at the expert level with major service providers, manage mission-critical issues and enforce technical service level commitments.
• Establish compliance monitoring systems to ensure alignment with architectural standards and security best practices.
• Oversee project performance, review deliverables and escalate issues as appropriate.

COMPETENCIES

Expert level:

• Technical Skills: Specialized knowledge and expertise in the tools, programs, domains, platforms and products used for specific tasks.
• Tech Savvy: Anticipating and adopting innovations in business-building digital and technology applications.
• Communicates Effectively: Developing and delivering multi-mode communications that convey a clear understanding of the unique needs of different audiences.
• Values Diversity: Recognizing the value that different perspectives and cultures bring to an organization.
• Collaborates: Building partnerships and working collaboratively with others to meet shared objectives.

Advanced level:

• Customer Focus: Building strong customer relationships and delivering customer-centric solutions.
• Cultivates Innovation: Creating new and better ways for the organization to be successful.