The Network Security Engineer provides security oversight to Columbia Credit Union’s computing environment. This role is critical to preventing material harm to CCU by providing security oversight to ensure that the Credit Union’s information assets are protected. Oversight is achieved through the design, architecture, and recommendation of security monitoring solutions. The Network Security Engineer monitors and investigates security events as reported by CCU’s security monitoring devices; through careful analysis – develops appropriate correlation rules to meet regulatory compliance requirements; performs vulnerability assessments and penetration testing; maintains the Threat & Vulnerability Management Program and Patch Management Program.
- Conduct security Web assessments and penetration tests of critical Credit Union applications (vendor hosted and in-house). Write detail technical reports and high-level executive summary
- Develop and maintain the CCU forensics program. This will include recommendations for best practices, documenting the relevant procedures and processes, & training members of the network security team.
- Configure, maintain, and monitor of the Security Incident and Event Monitoring (SIEM) system. Develop and implement use cases to support the monitoring of the Credit Union’s infrastructure and ensure that regulatory compliance (e.g. GLBA, SOX) is maintained.
- Participate as a member of the Information Security Incident Response Team, by monitoring, identifying, documenting and making recommendations to management.
- BS in Computer Science or equivalent. 5 years relevant Security Experience, 7 years comprehensive IT Experience.
- Technical network (e.g. CCNA, CCNP or CCNE) and security certifications highly desirable (e.g. CISSP, CISA, GPEN, and/or GWAPT).
- Excellent knowledge of web application penetration testing methodology and reporting, AJAX, Flash, SSL, SQL Injection, and Client authentication. Knowledge of OWASP top 10 application security risks.
- Good knowledge of identifying and exploiting vulnerabilities and providing remediation efforts in a network environment. Beneficial if experienced in Database Activity Monitoring (DAM) systems, and Web Application Firewalls (WAF), Mobile Security systems and applications.
- Experience in Windows environments, Active Directory, VPN systems, encryption schemas and algorithms, various authorization & authentication mechanisms/software, network monitoring and sniffing, TCP/IP networks and vulnerability and threat management tools (including network-based scanners).
- Ability to: provide quality deliverables on time and on budget; mentor peers; design, resource, conduct, status, and complete projects independently, with minimal supervision.