Information Security Specialist, Security Engineer

Information Security Specialist, Security Engineer

Sacramento, CA

Duration: Long term

Mandatory Qualifications

Ten (10) years or more of Security Engineer experience performing the following tasks:

1. Leading data classification and categorization effort and documenting the results in accordance with Data Classification and Categorization Standards;
2. Working with customers to identify and document business impacts and system security classification and data categorization ratings;
3. Performing SAST (Static Application Security Testing) and DAST (Dynamic Application Security Testing) common tools and provide results and remediation execution approach to management, developers, business analyst, and tester;
4. Developing and presenting security remediation approach to senior management, developers, business analysist, and testers, including an execution plan;
5. Implementing ZeroTrust/Continuous authentication architectures;
6. Classifying issues identified via SAST and DAST tools based on risk and criticality;
7. Documenting security reports for “As is” applications, developing security user stories and task for the developers to address security vulnerabilities;
8. Performing and collaborating on analysis with other technical staff to identify and document security issues for application components and supporting infrastructure, such as:
   a. Non-standard or low-security authentication methods for users, systems, and infrastructure
   b. Reused or common credentials
   c. User credentials in code
   d. Unencrypted end-user passwords and Personal Identifiable Information (PII)
   e. Missing security controls based on the data classification and categorization
9. Collaborating with Software Developers to identify and document approaches to remediate security issues, including plans to validate security fixes and improvements;
10. Collaborate with developers implementing an IAM (Identity and Access Management) solution.

Desirable Qualifications

1. Possession of a *Master’s Degree from an accredited university or equivalent in the fields of Computer Science, Information Technology, or Cybersecurity
2. Certified Information Systems Security Professional (CISSP) License;
3. Ten (10) years or more of Security Engineer experience using Mend and Invicti or similar tools
4. Minimum of five (5) years of experience supporting security practices in a cloud environment (AWS, Azure, etc).