Cybersecurity Engineer


Description:

Job Description Summary:
The Cybersecurity Engineer reports directly to the Executive Director Information Technology & Information Security Officer within the Division of Strategy Innovation & Operations. The person in this position is a key member of the Division of Strategy Innovation & Operations, and as part of a team of professionals across the Division, will support the security of Samuel Merritt Universities enterprise network, systems, and information assets. Samuel Merritt University fundamentally depends upon a high-availability, state-of-the-art production networked computing environment for academic, administrative, and research functions. Consistent with this, the Cybersecurity Engineer supports the University’s mission, goals, and strategic initiatives across academic, administrative, and research operations. The incumbent will play an important role in recommending, planning, and implementing security provisioning. This position requires a proven and successful professional who has the combination of skillset and mindset required to be an effective member of a high-performing team of professionals. Beyond technical skills, this position requires excellent communication, collaboration, teamwork, transparency, and service ethic in order to be successful.

As is the case with all areas of the Information Technology, a fundamental responsibility of this individual is being highly user-centric and working directly with users. This will involve engagement including significant consulting and collaborating with users and ensuring excellent customer service and responsiveness regarding security questions and issues. It will also require complete engagement, transparency, and collaboration with other members of the unit and the Division. This is an hybrid position with an established work schedule. The position also requires the ability to work off-hours and weekends as necessary to meet the needs of the University. This may include non-scheduled onsite problem response when necessary.

Duties and Responsibilities:

Job Duties and Accountabilities:

(30%)
  • Overseeing daily operation of the University’s information security systems, as well as ensuring that cybersecurity situational awareness is maintained continuously
  • Acting as a liaison between IT and Academics for coordinating the execution and documentation of research technology systems, including information security processes of a Controlled Unclassified Information environment adhering to the NIST SP 800-53, and especially NIST SP 800-171
(30%)
  • Implementing and operating campus intrusion detection systems, intrusion prevention systems, SIEM, and other tools to detect, respond to, and mitigate information security-related vulnerabilities and incidents
  • Reviewing and processing threat intel reports and sources (e.g. security events, network traffic, logs, etc.) and formulating these into actionable intelligence for Divisional members and leaders
  • Serving as a resource person in assessing systems, processes, and projects against compliance requirements, control objectives, and security best practices for all campus information systems including but not limited to information systems dedicated to research grants and awards
(15%)
  • Evaluating current and future security-related requirements and developing or recommending technical and operational solutions accordingly
  • Researching, developing, testing, analyzing, documenting, and recommending SOC tools and applications
  • Assisting the ISO in delivering information security technologies and services to the campus including but not limited to patch management, vulnerability scanning, system hardening, encryption services, and configuration review
(10%)
  • Monitoring general and specific threat intelligence, and assisting with cybersecurity tools, malware analysis, and implementation of threat detection analytics
  • Working with User Support Services to address security issues and concerns, and acting as Level 2 response for user security challenges
(10%)
  • Providing training, support, mentoring, and coaching to users, including students and other staff members
(5%)
  • Perform other related duties as assigned.
Breakdown of Essential Duties and Responsibilities:
(30%) Information Assurance security
(30%) Vulnerability Management
(30%) Programmatic, planning, and requirements creation for security
(10%) Other duties as assigned in support of overall IT strategic goals and synergy within IT

Required Qualifications:
  • Bachelor’s degree with a major directly related to the responsibilities of the position; equivalent combination of training and experience may be considered
  • 3-5 years substantial professional experience directly related to the responsibilities of the position (e.g. information security, network security, system security)
  • Must be able to achieve government clearance to assist campus with security and research tasks
  • Direct, hands-on practical experience in the use of security monitoring and detection systems and tools as well as access control mechanisms
  • Strong knowledge of NIST Special Publications; specifically, NIST SP 800-53 and NIST SP 800-171, and other NIST Special Publications, including the NIST and DoD Risk Management Framework
  • Ability to develop Institutional System Security Plans (SSPs) and to include Plans of Actions and Milestones (POA&Ms) is essential
  • Ability to build necessary documentation to comply with all controls of DFARS 7012 / NIST 800-171, NIST 800-53 (low, moderate, or high) or the NIST Cybersecurity Framework (NIST CSF)
  • Solid working knowledge of the NIST Risk Management Framework and Security Controls and their application
  • Experience with a variety of web application protocols, web services, scripting capabilities, software development frameworks, operating systems, and networking technologies
  • Technical knowledge and understanding of operating systems, network architecture (i.e. routing, switching, VLANs, segmentation, NAC) and design, access controls and authentication methodologies, Active Directory, and similar fundamentals
  • Knowledge of encryption and key management
  • Excellent interpersonal and written communication skills and the ability to communicate effectively with both highly technical and non-technical audiences
  • Strong self-initiative and work ethic
  • Ability to work effectively as a positive, engaged, transparent member of a high performing / collaborative team of professionals
  • Ability to handle multiple priorities in a highly dynamic and fast-paced environment
  • Strong organizational, prioritization, and time management skills
  • Strong analytical, systems thinking, and problem-solving skills
  • Sound judgement and decision-making commensurate with the responsibilities of the position
  • Commitment to professional growth and experience
  • Weekend/off-hours work as needed or required
Preferred Experience:
  • 5-7 years of intensive professional experience in information security in a large, complex, production network
  • Substantial professional experience in higher education and research environments, providing infrastructure support for academic, administrative, and research functions
  • Substantial professional training in security, with corresponding certifications (e.g. SEC+ CE, CySA+, GICSP, GSEC, SSCP, CISSP)
  • At least 2 years conducting compliance assessments in a NIST SP 800-53, specially NIST SP 800-171 environment
  • Familiarity with common compliance frameworks (e.g., ISO, HIPAA, NIST, COBIT, etc.)
  • Knowledge of the application and utilization of endpoint threat intelligence technologies
  • Familiarity with a variety of web application protocols, web services components (e.g. JavaScript, XML, JSON), scripting capabilities (e.g. Power Shell, Python), and/or web application frameworks (ASP, .NET, J2EE)
  • Proficient knowledge of network security including firewalls and network monitoring and alerting systems, as well as vulnerability assessment and threat mediation
  • Experience in network / host-based intrusion analysis, malware analysis, and forensics
  • Training and knowledge of advanced persistent threats, data exfiltration techniques, and similar advanced security issues
The University has an institution-wide commitment to diversity, equity and inclusion. We strive to build a welcoming and supportive campus environment, and acknowledge that diversity is an educational imperative to achieve excellence.

Employee Status:
Regular
Exemption Status:
United States of America (Exempt)
Time Type:
Full time
Job Shift:

Get job alerts

Create a job alert and receive personalized job recommendations straight to your inbox.

Create alert