What are the responsibilities and job description for the Cyber Security Consultant position at Innoflexion?
Cybersecurity Engineering Services develop advanced security solutions in line with Metro specifications, regulations, and compliance.
Basic Functions
1. Assist with security strategy updates addressing the evolving risk landscape.
2. Assist with security governance, aligned to NIST CSF, as required to sustain an effective cybersecurity program.
3. Assist with 3rd parties/projects/initiatives security risk assessments and provide solutions recommendations as needed.
4. Assist with security operations management update/improvement as required.
5. Manage information security-related activities of the agency including the analysis, identification, estimation of InfoSec efforts and the development, planning, testing, and documenting of remediation measures.
6. Develops, conducts, and documents executive-level reporting and strategy formulation.
7. Creates and maintains a centralized information security register to manage all InfoSec information and document changes relevant requirements.
8. Collaborates with internal and external stakeholders to maintain an understanding of current risks, new systems, and changes to the environment.
9. Supports development, implementation, and maintenance of strong security risk & compliance processes for new and existing deployments.
10. Participates in vendor due-diligence processes and third-party security risk management efforts; in addition to performing contract reviews as it relates to Information Security.
11. Supports internal and external audit and assessment processes for relevant compliance (PCI DSS, Privacy, etc.).
12. Creates security guidelines, checklists, and other documentation to support projects and initiatives.
13. Develops and presents metrics, reports, and dashboards.
14. Develops documentation for information security controls, acquisitions, and process or system changes.
15. Stays up to date on developing regulatory concerns, evolving IT, and information security trends.
16. Contributes to ensuring that the Equal Employment Opportunity (EEO) policies and programs of Metro are carried out.
17. May be required to perform other related job duties .
Knowledge & Experience Requirements
1. Experience working with a transit Universal Fare System (UFS) and the Cubic Payment Application (CPA) as it relates to transportation agency data compliance.
2. Knowledge of cybersecurity technology and compliance in transit systems.
3. Demonstratable strong background in the processes, policies, procedures, systems, practices, and professional standards of cybersecurity.
4. Demonstratable knowledge of industry best practices and relevant legal requirements as they pertain to cybersecurity, compliance, and privacy laws and regulations including TSA/DHS transport directives, DMV rules and regulation and other transportation agency cyber security rules and regulations.
5. Consultant must have delivered similar services (as stated above) during the past 10 years.
6. Experience with modern Security Operations Center (SOC) monitoring, detecting, analyzing, and responding to cyber threats.
7. Experience with conducting Cyber forensics.
8. Experience with major Cyber Incident handling.
9. Experience with preparing and guiding organizations to achieve and sustain compliance with Payment Card Industry Data Security Standard (PCI DSS).
10. Experience with vulnerability scanning, penetration testing, etc. using commercial products.
11. Experience with risk-based prioritization of security vulnerabilities and providing actionable remediation guidance.
12. Experience with cloud based and on-premise Security Information and Event Management (SIEM) tools including administering the tools, reviewing alerts, and providing actionable steps.
13. Experience with Security Orchestration, Automation, and Response (SOAR) platform.
Minimum Requirements:1. 15 years’ experience supporting with data and network security remediation and other regulatory compliance initiatives.
2. Two of the certifications below:
a. Certified Information Systems Security Professional (CISSP)
b. Certified Information Systems Auditor (CISA)
c. Certified Information Security Manager (CISM)
d. GIAC Security Professional (GSEC)
e. Certified Data Privacy Solutions Engineer (CDPSE)
f. Cyber Security Nexus (CSX)