Information Security Engineer - FT- Days -Information Security

DHR Health - US:TX:Edinburg - Days

Summary:

POSITION SUMMARY:

(The Security Engineer plays an integral role in defining and assessing the organization's security strategy, architecture and practices. The Security Engineer may be required, based on the overall size and available competencies within the security team, to assume responsibility for certain security functions. The Security Engineer will be required to effectively translate business objectives and risk management strategies into specific security processes enabled by security technologies and services. The Security Engineer is expected to contribute his/her insights not only to colleagues within the security team and the CISO, but also to colleagues within IS.

POSITION EDUCATION/ QUALIFICATIONS:
Bachelor's or Master's degree in computer science, information systems, cybersecurity or a related field. 5 years' post-bachelor's experience in information security.
Experience in healthcare settings is preferred.
Experience with TrendMicro smart protection suites and other TrendMicro products such as Deep Discovery Inspector, Deep Discovery Email Inspector, Deep Discovery Analyzer, Tipping Point ... etc.
Direct, hands-on experience managing security infrastructure such as firewalls, IPSs, WAFs, endpoint protection, SIEM and log management technology
Verifiable experience reviewing application code for security vulnerabilities
Direct, hands-on experience using vulnerability management tools
Documented experience and a strong working knowledge of the methodologies to conduct threat-modeling exercises on new applications and services
Full-stack knowledge of IT infrastructure:
Applications
Databases
Operating systems (Windows, Unix and Linux)
Hypervisors
IP networks (WAN, LAN)
Storage networks (Fiber Channel, iSCSI and network-attached storage)
Backup networks and media
Direct experience designing IAM technologies and services (e.g., Active Director, LDAP, Amazon Web Services' [AWS'] IAM)
Strong working knowledge of IT service management (e.g., ITIL-related disciplines):
Change management
Configuration management
Asset management
Incident management
Problem management
Experience with industry and regulatory frameworks; PCI, HIPAA, HITECH, HIRTUST, ISO27001.

Responsibilities:

POSITION RESPONSIBILITES:
Develop and maintain security architecture artifacts (models, templates, standards and procedures) that can be used to leverage security capabilities in projects and operations.
Track developments and changes in the digital business and threat environments to ensure that these are adequately addressed in security strategy plans and architecture artifacts.
Participate in application and infrastructure projects to provide security planning advice.
Draft security procedures and standards to be reviewed and approved by executive management and/or formally authorized by the CISO or the individual responsible for overall security direction.
Determine baseline security configuration standards for operating systems (e.g., operating system hardening), network segmentation, and identity and access management (IAM).
Develop standards and practices for data encryption and tokenization within the organization based on the organization's data classification criteria.
Conduct threat modeling of services and applications that tie to the risk and data associated with the service or application.
Conduct security assessments of internal systems, applications and IT infrastructure as part of the overall risk management practice of the organization.
Conduct vulnerability assessments and other security reviews of systems, and prioritize remediation based on the risk profile of the asset and guidance from the CISO or other executive management.
Review and assess security and infrastructure logs for indicators of compromise (IOCs) or other anomalous behavior within networks, applications or user profiles.
Ensure that a complete, accurate and valid inventory of all systems, infrastructure and applications is conducted that should be logged by the security information and event management (SIEM) or log management tool.
Establish a taxonomy of indicators of compromise (IOCs) and share this detail with other security colleagues, including the security operations center (SOC), network operations center (NOC).
With guidance from the CISO, or the individual responsible for overall security direction, and in conjunction with SOC colleagues, establish procedures - including escalations - for when IOCs are discovered.
Conduct code reviews of applications to determine security flaws or other issues that would impact the confidentiality, integrity or availability of the system.
Coordinate with DevOps teams to advocate secure coding practices and escalate concerns related to poor coding practices to the CISO or the individual responsible for the overall security direction.
Validate IT infrastructure and other reference architectures for security best practices, and recommend changes to enhance security and reduce risk where applicable.
Validate security configurations and access to security infrastructure tools, including firewalls, intrusion prevention systems (IPSs), Advanced Breach Detection products such as Deep Discovery, web application firewalls (WAFs), anti-malware/endpoint protection systems, etc.
Review network segmentation to ensure least privilege for network access.
Conduct reviews of and oversee the change management function for security rulesets for the organization's firewalls.
Validate that security and other critical patches to firmware and operating systems are configured and deployed in a timely fashion.
Liaise with the project management team to conduct security assessments of existing and prospective vendors, especially those with which the organization shares intellectual property, PII, ePHI, regulated or other protected data.
Liaise with the Information Services team to review and evaluate the design and operational effectiveness of security-related controls.
Support the testing and validation of internal security controls as directed by the CISO.
Review security technologies, tools and services, and make recommendations to the broader security team for their use based on security, financial and operational metrics.
Conduct incident response exercises with colleagues throughout the organization and incorporate lessons-learned into existing security architectures and practices.
Conduct forensic analysis of security-related incidents in a manner consistent with guidance from the organization's counsel, human resources or law enforcement, as the case may be.
Coordinate with operational and facility-management teams to assess the security of operational technology and Internet of Things (IoT) systems.
Liaise with security team and other Information Services teams to share best practices and insights.

Other information:

LINES OF REPSONSIBILITES:

(Chain-of-command)

1. (CISO) 2. (Director)

CUSTOMER SERVICE:

Provide excellent customer service to all DHR customers. All employees are required to attend the DHR C.A.R.E.S program which outlines the Customer Service Principals including: Commitment, Accountability, Respect, Excellence and Service.

AGE SPECIFIC:

Employees must be able to demonstrate the knowledge and skills necessary to provide care appropriate to the age of the patients served in his/her assigned unit. The individual must demonstrate knowledge of principles of growth and development over the life span and possess the ability to assess data reflective of the patient's status and interpret the appropriate information needed to identify each patient's requirement relative to his or her age.

AMERICANS WITH DISABILITIES ACT: (ADA):

A. Essential Duties: Indicated by bold print within performance standards, preceding individual numbered criteria.

The following table provides physical requirements that will be associated with, but not limited to, this position:
Light/moderate lifting up to 20 lbs, from the floor to shoulder height.
Yes
Kneeling
Yes
Must be able to assist other employees with lifting more than 20 lbs.
Yes
Walking
Yes
Light/moderate carrying up to 20 lbs.
Yes
Standing/Squatting
Yes
Straight pulling
Yes
Sitting
Yes
Pulling hand over hand
Yes
Pushing
Yes
Repeated bending
Yes
Stooping/Bending
Yes
Reaching above shoulder
Yes
Climbing Stairs
Yes
Simple grasping
Yes
Climbing Ladders
No
Dual simultaneous grasping
Yes
Depth Perceptions needed
Yes
Ability to see
Yes
Identify Colors
Yes
Operating office equipment
Yes
Twisting
Yes
Operating mechanical equipment
Yes
Crawling
No
Ability to read and write
Yes
Ability to Count
Yes
Ability to hear verbal communication without aid
Yes
Operating Personal Vehicle
Yes
Ability to comprehend written/verbal communication
Yes
Other: Ability to deal with stress
Yes
OSHA Category
III

B. Working Conditions: The individual spends over 95% of his/her time in an air-conditioned environment with varying exposures to noise. There is protection from weather conditions but not necessarily from temperature changes. The position does have low exposure to malodorous, infectious body fluids from patients and some minimal exposure to noxious smells from cleansing agents.

C. Occupational Exposure: This position has minimal to no exposure to blood, body fluids, or tissues and is an OSHA Category III (although situations can be imagined or hypothesized under which anyone, anywhere, might encounter potential exposure to body fluids). Person who performs these duties are not called upon as part of their employment to perform or assist in emergency medical care or first aid or to be potentially exposed in some other way.

D. Aptitudes: HIGH 1 2 3 4 5 6 LOW

Intelligence: General learning ability: The ability to "catch on" or understand instructions and underlying principles. Ability to reason and make judgments. 3

Verbal: Ability to understand meanings of words and ideas associated with them, and to use them effectively. To comprehend language, to understand relationships between words, and to understand meanings of whole sentences and paragraphs. To present information or ideas clearly. 3

Numerical: Ability to perform arithmetic operations quickly and accurately. 2

Spatial: Ability to comprehend forms in space and understands relationships of plane and solid objects. Frequently described as the ability to "visualize" objects or two or three dimensions, or to think visually of geometric forms. 2

Form Perception: Ability to perceive pertinent details and objects or in pictorial or graphic material to make visual comparisons and discriminations and see slight differences in shapes and shadings of figures and widths and lengths of lines. 3

Clerical Perception: Ability to receive pertinent details and verbal or tabular material. To observe differences in copy, to proofread words and numbers, and to avoid perceptual errors in arithmetic computation. 2

Motor Coordination: Ability to coordinate eyes and hands to fingers rapidly and accurately in making precise movements with speed. Ability to make a movement response accurately and quickly. 3

Finger Dexterity: Ability to move hands easily and skillfully. To work with fingers in placing and turning motions. 3

Manual Dexterity: Ability to move hands easily and skillfully. To work with hands in placing and turning motions. 3

Eye-Hand-Foot Coordination: Ability to move the hand and foot coordinately with each other in accordance with visual stimuli. 3

Color Discrimination: Ability to perceive and respond to similarities or differences in colors, shapes, or other values of the same or different color. To identify a particular color, or to recognize harmonious or contrasting color combinations, or to match color adequately. 3

I have read and reviewed my job description with my supervisor or designee and I understand the job I am expected to perform.

If applicable ____________ certification will be completed within _________ time frame of hire/transfer date.

Employee Signature: Date:

Transfer/Hire Date Effective: .