Staff I.T. Job Informtion

Apply for this Job
Information Security Consultant
Job Number	5378
WorkLocation	NY - New York City
Category	Compliance/Risk/Security Expert
Duration
Job description:

•Implement and manage a comprehensive Information Security Program based on ISO 2700x Framework
•Participates with the Information Security team to plan, develop and execute vulnerability assessments and penetration tests.
•Configures enterprise vulnerability assessment and penetration testing tools, performs internal/external scans, analyzes detected vulnerabilities, identifies the relevant threats and eliminates false positives through manual validation.
•Uses application development, code review and database skill set to demonstrate how vulnerabilities are exploited.
•Generates reports on assessment findings and summarizes them to facilitate remediation tasks for other operational teams.
•Recommends security controls and/or corrective actions for mitigating technical or business risk.
•Prepares reports and metrics on the status of completed assessments, progress of remediation actions and performance of the assessment tools.
•Creates and updates documentation for the vulnerability and penetration testing process; including procedures on using the assessment tools, appropriated configuration settings, implementing process enhancements, and validating vulnerabilities.
•Assists in conducting security reviews of new and existing applications.
•Maintains an awareness of existing and proposed security standards, industry best practices, legislation and regulations pertaining to information security and recommends appropriate changes.
•Identifies process improvements, prevent/anticipate problems and focus on continuous improvement from manual to automated processes.
•Work with Service Desk, Engineering and Development teams to provide security governance, create policies, Guidelines, Standards and Procedures to ensure the confidentiality, Integrity and availability of the Information Program.
•Incident Response handling

Qualifications/Selection Criteria: 

•Bachelor degree in related discipline preferred; Information Security and control certifications preferred in one or more of the following; CISSP, CISA, PCI QSA
•Technical experience in security aspects of multiple platforms, operating systems, software, communications, LAN/WAN, wireless, VPN and network protocols.
•Very good knowledge of network architecture, perimeter structure and design.
•Experience with using vulnerability assessment tools such as; Nessus, Qualys, Metasploit, NMap, AppDetective, WebInspect, Fortify.
•Some experience in software development and programming with; Java, C++, Perl, SQL, .NET, VB, Shell scripts is helpful.
•Good understanding of information security standards, frameworks and best practices from; ISO2700x, OWASP.
•Ability to evaluate system designs for compliance to PCI, HIPAA, ISO guidelines. 

Familiarity with MacAfee EPO, endpoint solutions ie (Anti-Virus, HIPS and Firewall solutions), Cisco Routers and Switches, Checkpoint Firewalls, VMware, Microsoft, PKI and Encryption.