Information Security Engineer

Sinclair Broadcast Group is hiring an Information Security Engineer based in Cockeysville, MD for an onsite role. This position supports an enterprise Vulnerability Management program, applying security-in-depth principles to reduce vulnerability risk across business units and the organization’s cloud and infrastructure environments.

The engineer will partner with internal stakeholders and external consultants to improve how Sinclair identifies, prioritizes, and remediates security issues. Work includes building and maturing vulnerability management services, measuring program effectiveness, and helping ensure compliance with company policies and standards.

Responsibilities

• Manage processes and solutions related to vulnerability management, application security, CIS benchmarks, and other security services as required.
• Collaborate professionally with stakeholders and business partners, using strong communication skills to support program execution.
• Plan methodically and execute tactically, with a strategic approach to achieving team and organizational goals.
• Lead initiatives that develop and mature vulnerability management services aligned to team objectives.
• Advocate for information security objectives and implement creative solutions that keep progress moving.
• Drive remediation by understanding the impact of findings and establishing communication channels with key stakeholders.
• Maintain awareness of current trends, recent publications, and emerging technologies related to risk and vulnerability management.
• Identify, prioritize, communicate, and mitigate security risks across on-premises and hybrid/multi-cloud environments.
• Produce frequent metrics to measure the efficacy and effectiveness of the vulnerability program.
• Identify business-critical systems and environments, including mapping data types across enterprise assets, databases, cloud environments, and applications.
• Work with outside vendors and consultants to identify tools that meet or exceed department needs.
• Exercise good judgment when solving problems in a way that aligns to team and corporate goals.
• Enforce compliance with company policies and standards.
• Support vulnerability management program activities related to remediation for application (DAST) scans, security assessments, vulnerability scans, and related risk management tools.
• Configure and tune security tools to identify weaknesses in systems, applications, databases, and cloud environments.
• Help the security team maintain a level of excellence.
• Develop and evaluate performance metrics to establish process success.
• Design, document, and implement procedures aligned with best practices for analyzing and evaluating risk, accuracy, completeness, internal integrity/consistency, testability, and system quality.
• Research emerging technologies and identify opportunities for adoption within vulnerability management and application security.
• Track progress for vulnerability management processes and continually improve for better speed, clarity, and smooth execution.
• Collaborate on and follow security engineering standards, methodologies, and sustainable processes.

Requirements

• Degree in an IT discipline, or equivalent work experience, or equivalent IT certifications.
• 3+ years of experience with vulnerability management, system and application scanning, coordinating remediation efforts, and building partner relationships for program success.
• 4+ years of experience taking ownership of project, enhancement, or other assignments through completion.
• Experience with major cloud vendors: Amazon Web Service, Azure, and Google Cloud Platform.
• Understanding of applying security controls to operating systems, cloud environments, databases, and applications.
• Hands-on experience using vulnerability scanning tools and driving enterprise-level remediation (examples include Qualys, Tanium, Bitsight, etc.).
• Experience with Asset Management and Reporting Platforms.
• Experience creating weekly metrics for vulnerability and risk reduction reporting.
• Professional-level security certifications preferred, such as Security+, Network+, CISSP, CEH, CISM.
• Familiarity with security industry standards and best practices, including ISO 27001 and the NIST 800-53 series.
• Working knowledge of network and/or security technologies.
• Other requirements as needed.

Technologies

• Vulnerability Management
• Application security
• CIS benchmarks
• DAST
• Amazon Web Service (AWS)
• Azure
• Google Cloud Platform (GCP)
• Qualys
• Tanium
• Bitsight
• Asset Management and Reporting Platforms
• ISO 27001
• NIST 800-53 series
• Security+
• Network+
• CISSP
• CEH
• CISM

Compensation and Benefits

Salary: USD 105,000 - 135,000 per year.

• Participation in a retirement plan
• Life and disability insurance
• Health, dental and vision plans
• Flexible spending accounts
• Sick leave
• Vacation time
• Personal time
• Parental leave
• Employee stock purchase plan