Threat & Vulnerability Security Analyst (CISSP)

InnoSoul, Inc; Florida; On-site; USD 85,000 - 125,000; Full time

Job summary

InnoSoul seeks an Information Security Analyst to support threat and vulnerability management, incident response, and PCI compliance. The role reports to the Manager – Security Risk and Compliance Office within Florida's Turnpike Enterprise and focuses on monitoring security events, maintaining FIM and endpoint systems, and cross-functional risk communication.

A bachelor’s degree and CISSP are preferred, with strong communication skills.

Qualifications

• Bachelor's degree in Computer Science / Computer Information Systems or related field or equivalent experience.
• CISSP certification or in the process of attaining.

Responsibilities

• Support the Threat and Vulnerability Management Program.
• Support Incident Response Process, Risk Assessments.
• Support PCI compliance and other enterprise security initiatives.

Skills

Tripwire

Windows & Linux servers

Threat & compliance reporting

Communication & analytics

Team collaboration

Flexibility

Independence

Security policies & governance

Compliance controls

InfoSec experience

Security best practices (NIST, PCI-DSS

Education

Bachelor's degree in CS / CIS or related

CISSP certification

Tools

Endpoint Security (Carbon Black)

Splunk Core/ES

Rapid7 Nexpose

BurpSuite

Metasploit

Job description

Job ID: FL-Doc147293 (97590511)3P

Security Analyst (CISSP) with Tripwire, Carbon Black Protection, Splunk, Rapid7, Nexpose, BurpSuite, UNIX/Linux, MetaSploit, auditing, vulnerability mitigation, NIST/PCI-DSS/SOC-2 and Incident Response experience

Location: 7941 Glades Rd. Boca Raton, FL (FDOT)
Duration: 12 months
Positions: 1 (1/3)
Interview: in-person Note: During the pandemic crisis, video interviews may replace in-person interviews.

Skills Needed
A – Working level knowledge of File Integrity Monitoring tools like Tripwire
A – Working level knowledge using Endpoint Security tools similar to Carbon Black Protection
B – Working level knowledge using Security Information and Event Management Tools like Splunk Core & ES
B – Working level knowledge using Network Vulnerability Assessment tools like Rapid7 – Nexpose
B – Working level knowledge using Application Vulnerability Assessment tools like BurpSuite or similar tool set.
A – Working level knowledge of Windows and UNIX/Linux server operating systems
C – Experience with penetration testing tools like MetaSploit and/or similar Security Frameworks
B – Experience with process lifecycle of the creation, management and compliance of security policies, procedures, standards and guidelines B
B – Experience with the processes of identifying appropriate controls to comply with security policies and regulations
A – Experience producing threat and compliance reports for a wide variety of audiences (technical and non-technical)
A – Excellent communication and analytical skills
A – Must work well with others as part of larger team and be able to collaborate on cross functional teams
A – Must be available and willing to work extended and/or alternative hours as needed for issue resolutions, roll-outs, system upgrades, etc.
A – Able to work independently toward goals set at a higher level

Knowledge and Experience Needed
A – 7 years of Information Security experience or related field
B – 5 years of experience in the areas of compliance, auditing, risk assessment, and vulnerability mitigation and remediation.
B – Knowledge of security best practices (e.g., NIST series); Industry security standards (e.g., PCI-DSS or SOC-2)

Responsibilities
1. Support the Threat and Vulnerability Management Program
2. Support of Incident Response Process, Risk Assessments
3. Support of Payment Card Industry (PCI) compliance and other enterprise security initiatives

Education and certifications
A – Bachelor's degree in Computer Science / Computer Information Systems or related field or equivalent experience.
B – CISSP certification or in the process of attaining

Description
This position reports to the Manager – Security Risk and Compliance Office, Information Technology Office – Florida's Turnpike Enterprise. The Information Security Analyst position is a core member of the Security Risk and Compliance Office (SRCO).
This role is responsible for day-to-day information security operational functions. These responsibilities include real time monitoring analysis and resolution of security events from multiple sources. This position is heavily focused on three aspects of threat and vulnerability management. The first is to manage and maintain the File Integrity Monitoring (FIM) & Endpoint Security Systems. The scope of the vulnerability management process includes: data, application, and infrastructure vulnerabilities and will be facilitated by a combination of manual processes and vulnerability management tools (listed below). The second aspect is to ensure that such vulnerabilities are prioritized and remediated by the appropriate operations team. This objective will require heavy cross-functional interaction to clearly communicate vulnerability risk posture with all operations and software development teams. The candidate will be required to create vulnerability management reports on a regular basis and present the information to multiple types of audiences. The final aspect of this role requires mid-level knowledge for monitoring security by analyzing IPS reports, firewall logs, vulnerability alert systems and operating systems, database, and application frameworks patch levels.

Skills and Experience Weighting
A = Candidate must have these attributes
B = Management strongly desires that the candidate have these attributes
C = Management desires the candidate to have these attributes

Doc147293.xlsx