Cyber Security Specialist

Major Duties/Responsibilities

• Data Collection (e.g., Defining Data Sources, Log Configuration and Management, Endpoint Security Logs, Cloud Service Logging, SIEM Configuration) to gather and analyze information to identify potential security threats and vulnerabilities. [30%]
• Security Information and Event Management (SIEM):
• Help to identify and enumerate the sources of security-relevant data within the organization.
• Ensure that logs capture relevant security events and activities.
• Collect logs from security devices such as firewalls, IDS/IPS, and web proxies.
• Maintain SIEM/Log Management Solution.
• Customize SIEM dashboards for real-time monitoring.
• Leverage automation using PowerShell and Python to create scripts and workflows to streamline tasks, especially security-related tasks. [30%]
• Vulnerability Scanning Automation:
• Integrate vulnerability scanning results into reporting and alerting systems.
• User Account Management and Automation
• Develop scripts to automate user provisioning and de-provisioning.
• Implement automated workflows for user role changes.
• Implement automated alerting based on predefined thresholds.
• Security Automation APIs
• Use Python/PowerShell to interact with security tool APIs for automation
• Support and develop information technology systems in one or more areas [20%]:
• Identity and Access Management (IAM):
• Develop and implement IAM policies and procedures.
• User provisioning/de-provisioning
• Access Requests and Approvals
• Role-Based Access Control (RBAC)
• Single-Sign-On (SSO)
• Conduct regular access reviews and audits
• Integration with other security tools
• Zero Trust Architecture
• Multifactor Authentication
• Performs other duties as required or assigned which are reasonably within the scope of the duties in this job classification.[10%]

Knowledge, Skills, and Abilities

• Advanced knowledge of PowerShell for system administration and automation.
• Ability to confidently install and configure network and security equipment while maintaining network productivity, efficiency, availability, and performance.
• Advanced knowledge of Microsoft 365 and Microsoft Security products for Identity & access,
• Experience with SIEM/Log Management systems and alert creation
• Working knowledge of authentication, authorization, remote access, and other access-control principles, products, and technologies.
• Knowledge and understanding of security tools and software, and an awareness of various access control mechanisms.
• Working knowledge of networking technology, e.g., TCP /IP, DNS, DHCP, and NAT, routing protocols, and packet capture/analysis.
• Working knowledge of networking requirements including routing, switching, and trust domains, as well as security best practices and technologies.
• Knowledge and understanding of Juniper networking hardware, Juniper SRX firewall configuration and administration.
• Ability to deal effectively with multiple problems and assignments, and to establish accurate priorities of work to be performed with minimal supervision.
• Ability to communicate clearly and effectively to both technical and nontechnical people. Must be able to present complex problems and information clearly and concisely, both verbally and in writing.
• Ability to work outside normal work hours as required for system maintenance or repair
• Functional knowledge of version control systems, specifically Git
• Functional knowledge of Linux command-line, specifically BASH
• General knowledge and understanding of one or more of the following security frameworks and standards:
• ISO 27001, NIST SP 800-171, NIST Cybersecurity Framework, CIS Controls v8, Cybersecurity Maturity Model Certification (CMMC) 2.0 program.