Associate Director, Information Security Engineer

Lead and oversee security monitoring for PPFA’s technology environment, with a focus on 24/7 SIEM operations, investigation, and escalation support.

Responsibilities

• Manage Information Technology security protections to protect PPFA and reduce the impact of security incidents and system compromises.
• Provide 24x7 security monitoring, event investigation, event analysis, and countermeasure recommendations.
• Support and guide Tier I Analysts.
• Provide technical assistance for Tier II & III incidents as assigned.
• Interface with the InfoSec Operations Team, MSSP, and IT Managed Service Provider (MSP) for security event architecture, collection, management, reporting, and alerting within PPFA SIEM platforms.
• Identify, implement, and maintain Information Security toolsets, primarily SIEM, to protect the organization.
• Partner with IT Ops to ensure proper security event logging setup.
• Support Information Security SIEM management needs of PPFA and Affiliates, where applicable.
• Serve as Subject Matter Expert for PPFA’s SIEM (currently Splunk) and handle configuration, management, operation, and administration from a managed SIEM perspective.
• Provide threat/risk analysis and security monitoring in a 24/7 environment.
• Ensure established processes for event identification are followed; recommend and implement new or refined event filtering updates as required.
• Ensure processes for collecting relevant data and completing the necessary levels of analysis are followed.
• Ensure events are assigned appropriately.
• Follow an established process for Tier II escalations, including identifying whether escalation originates from MSSP, MSP, Affiliate, or other sources and using the appropriate triage and documentation process.
• Create and maintain Standard Operating Procedures (SOPs) for the Information Security Ops group and recommend security process improvements.
• Support and participate in complex security tool-specific tasks with assistance from management and vendor/MSSP resources.
• Assist in vulnerability assessment setup, scanning, analysis, and remediation efforts with IT Ops staff and corporate vendors to correct errors and alerts found in IT infrastructure systems.
• Assist with IR incidents as assigned by management.
• Perform all other duties as assigned.

Requirements

• Bachelor’s degree and 5+ years of industry experience.
• Ability to make independent decisions, including determining analysis tracks for escalated events, analysis assignments, and escalation decisions ranging from base Tier I events to Incident Response-level remediations.
• Experience with compliance requirements and standards such as PCI, HIPAA, ISO 27001, NIST, CSF, MITRE ATT&CK, ITIL, COBIT, Sarbanes-Oxley, and SANS 20.
• Experience with UNIX, AIX, Solaris, Linux, and Windows Server operating systems.
• Knowledge of Network/System Intrusion Detection or Prevention Systems (IDS/IPS).
• Experience with Security Information and Event Management (SIEM).
• Experience with vulnerability scanner and penetration testing systems.
• Wireless networking experience.
• Familiarity with switches/routers and firewalls (basic configuration).
• Knowledge of TCP/IP networking, VPN, VLAN, NAT, and security concepts.
• Experience with Software & Hardware Asset Management.
• Experience conducting forensic analytical studies and investigations.
• Flexibility to adapt to quickly changing priorities and ambiguous situations.
• Strong commitment to Planned Parenthood’s mission of promoting Sexual and Reproductive Health.

Technologies

• Splunk, SIEM
• UNIX, AIX, Solaris, Linux, Windows Server
• IDS/IPS
• Vulnerability scanner, Penetration testing systems
• Wireless Networking
• Switches/Routers, Firewalls (basic configuration)
• TCP/IP, VPN, VLAN, NAT
• MITRE ATT&CK
• PCI, HIPAA, ISO 27001, NIST, CSF, ITIL, COBIT, Sarbanes-Oxley, SANS 20

Travel

• 0-10% travel as needed.

Location: New York, NY (onsite) • Salary: USD 125,000 - 130,000 per year