Senior Security Engineer

Senior Security Engineer    

Reporting Line: Security Delivery Manager

Role/Responsibilities:

-Conduct threat modelling and security assessments to identify security risks

-Maintain the local IT Security Reference Architecture taking into account assets, Enterprise Architecture, security policies, standards and best practices, the Cyber Security Baseline, threat models, risk assessments, contractual and legal requirements

-You will act as an internal security consultant to advise or influence business and technical partners

-Build productive working relationships and collaborate with the wider Technology team and the relevant business units to identify the right Security Architecture and controls for new solutions, products and modules

-Develop the Security Testing Strategy and Security Testing Plans across multiple projects being delivered in a release or across multiple work-streams in a program

-Provide IT Security assurance, guidance and support for projects and change requests

-Identify, prioritise, design, test and report on the security controls required to bring the identified security risks within the accepted risk tolerance; work closely with project resources (architects, developers, testers, Operations) at a technical level to assist with the effective mitigation of security risks

-Verify vendor mitigation plans in terms of alignment to the local IT Security Reference Architecture, coverage, efficiency, dependencies and implementation schedule

-Represent Technology Security during project sizing sessions and gate reviews; provide high level (VROM) estimates of effort (time & cost); ensure estimates and security testing and acceptance criteria are agreed, documented and met

-Ensure security testing and mitigation reports for programme boards and steering committees follow the agreed format and are delivered on time; escalate security risks as required

-Provide architectural guidance for secure software development, integration and testing

-Ensure a consistent approach and manage security interdependencies across multiple projects and work streams

-Act as the escalation point for security assessments and testing

-Manage contingency / unplanned security (re)assessment and (re)testing

-Provide input for the implementation of the Cyber Security Baseline

-Review project changes that impact the security assessment or testing

-Adopt and promote a culture of continuous improvement to minimise inefficiencies

Experience: 

-3+ years IT Security experience

-Excellent knowledge of IT Security technologies

-Solid vendor management experience, proven experience managing complex integration issues across multiple vendors with very good analytical and reporting skills

-In-depth knowledge of system development life cycle, security standards (ISO27k, OWASP, NIST, SANS etc.), system hardening, network security

-Bachelor/Master of Science degree in Computer Science, Engineering, Telecommunications or another related technical degree (Relevant certs are an advantage, e.g. TOGAF, ITIL, PMP, ISO27k LA/LI, (ISC)2 CISSP, ISACA CISM/CISA/CRISC, SANS GIAC).

-Solid knowledge of telecom systems, networks, protocols and processes (e.g. billing, mediation, provisioning, signalling, VoIP etc.)