Information Security Analyst - Senior

Role Overview: FTC supports the Department of Justice, Tax Division by providing IT Support and IT Security services.  This position will be part of a team responsible for providing support Information Security Analyst (ISA) serves as the principal advisor to the Information System Owner (SO), in relation to all matters (technical and otherwise) pertaining to the security of the assigned information system. To develop, implement, assess and maintain the appropriate system-level information system security controls in accordance with Department of Justice, NIST 800-53 (as amended), federal government-wide laws regulations, policies, procedures, and standards. Conduct enterprise-wide IT systems security reviews, audits, vulnerability assessments, risk assessments and evaluations regarding compliance with security requirements in accordance with industry best practices and applicable government regulations, standards and guidance to ensure that cloud, applications, systems, networks, data and users adhere to systems security policies, procedures and FISMA regulations.

Responsibilities:

• Assist with reviewing and evaluating recommendations on the court's technology security program, including automation, telecommunications, and other technology utilized by the Tax and Department of Justice
• Coordinate with Tax and other Department of Justice personnel, facilities staff and outside vendors to execute planned course objective
• Assist with promotion and support security services available throughout the Tax and Department of Justice
• Assist in the development and maintenance of local court unit security policies and guidance, the remediation of identified risks, and the implementation of security measures
• Make recommendations regarding best practices and implement changes in policy
• Provide security analysis of IT activities to ensure that appropriate security measures are in place and are enforced. Conduct security risk and vulnerability assessments of planned and installed information systems to identify weaknesses, risks, and protection requirements.
• Take measures to remediate identified vulnerabilities
• Assist with the identification, implementation, and documentation of security safeguards on information systems. Assist with information security projects (or security-related aspects of other IT projects)
• Serve as a liaison with court stake holders to integrate security into the system development lifecycle. Educate project stakeholders about security concepts and create supporting methodologies and templates to meet security requirements and controls
• Recommend changes to ensure information systems' reliability and to prevent and defend against unauthorized access to systems, networks, and data
• Assist with the creation and employment of methodologies, templates, guidelines, checklists, procedures, and other documents to establish repeatable processes across the courts' information technology security services
• Assist with establishing mechanisms to promote awareness and adoption of security best practices
  • Perform other routine IT administration duties as assigned by the Systems Manager

• Three years of hands-on experience providing technical support on an enterprise environment with over 600 users using configuration management tools like Microsoft SCCM ,Crowdstrike, WSUS, IBM BigFix, ForeScout, Tenable Nessus scanner, etc.
• Three years of experience being responsible for the deployment, maintenance, and use - or evaluation - of industry-standard information security technology products (such as IDS/IPS, SIEM/SEM, VPN, Splunk, forensic tools, and/or vulnerability management, compliance, penetration testing solutions)
• Ten years of experience with Microsoft Windows client operative system scripting, deployment and troubleshooting, and COTS installation and troubleshooting.
• Ten years of experience in a network environment performing computer security activities such as incident analysis and response, threat analysis and mitigation, vulnerability assessment, or computer forensics
• Solid writing and verbal communication skills to present information at different organization levels
• Ability to clearly communicate technical concepts to both technical and non-technical audiences
• Ability to manage multiple high priority projects simultaneously
• Azure certifications (Azure Security Engineer or Azure Architect) are required. CISSP is desired

Professional Certification(s):

N/A

Formal Education:

Technical degree or Bachelor’s Degree in computer science, information systems, engineering, or related field. Experience can be substituted for degree.

Years of Professional Experience:

10 years

• Hands-on experience with Splunk, Tennable, Crowdstrike, Varonis,
• Leadership in Security and Vulnerability Management teams
• Scripting and automation experience in enterprise environments

Professional Certification(s):

CompTIA Security , CISSP, Certified Authorization Professional (CAP), Certified Ethical Hacker (CEH) or Security , Certified Information Systems Manager (CISM)

Formal Education:

Technical or College Degree preferably in an IT Security field

Years of Professional Experience:

10 years of relevant experience

• IBM BigFix
• CISSP
• CAP
• CEH
• CISH