SECURITY ARCHITECT - CORPORATE IT SECURITY - FIRSTBANK PR
FirstBank
San Juan, PR
Permanente
Tiempo completo
Hace 2 meses
SECURITY ARCHITECTJob SummaryThe Security Architect ensures that security requirements necessary to protect the organization's mission and business processes are adequately addressed in all aspects of enterprise architecture including reference models, segment and solution architectures, and the resulting systems supporting those missions and business processes.As part of the functions, this role will perform complex analysis of high impact and sensitive systems to determine the appropriate security approach based on anticipated threat vectors. The Security Architect will be part of the Corporate Security Office (CSO) which is responsible of managing the Bank's Information Security strategy such as developing IT standards, policies, and procedures, to comply with applicable laws/regulations and industry best practices.Essential Responsibilities· Develop/integrate cybersecurity designs for systems and networks with multilevel security requirements or requirements for the processing of multiple classification levels of data primarily applicable to government organizations.· Document and address organization's information security, cybersecurity architecture, and systems security engineering requirements throughout the acquisition life cycle.· Assist in the development of Corporate Security Standards.· Employ secure configuration management processes. Monitor and ascertain system configurations remail in compliance with Corporate Standards.· Ensure that acquired or developed system(s) and architecture(s) are consistent with organization's cybersecurity architecture guidelines.· Define and document how the implementation of a new system or new interfaces between systems impacts the security posture of the current environment.· Evaluate security architectures and designs to determine the adequacy of security design and architecture proposed or provided in response to requirements contained in acquisition documents.· Determine the protection needs (i.e., security controls) for the information system(s) and network(s) and document appropriately.· Assist in the selection and tailoring of approaches, methods, and tools to support service offerings to applicable business units.· Actively participate in the Vulnerability Management Board (VMB) and oversight of the Patch Management efforts to provide feedback and best practices to remediate any outstanding risks/flaws.· Periodically report on the Cyber Security Posture of the Corporation to Senior and Executive Management· Perform research and analysis of emerging and disruptive Information Technology / Information Security trends and tendencies that may affect the Corporationo Conduct intelligence analysis of external threats targeting the financial industry as well as leverages internal data stores in order to gauge the potential impact on business operations.o Monitor vulnerability notices and provide engineering support for security patch distribution.Other Responsibilities· Train users in implementation or conversion of systems.· Capable of mapping complex technical requirements, functionality, and capabilities to prescribed security controls, policies, and practices.· Ability to receive and accurately interpret complex ideas/information, to effectively transmit to applicable stakeholdersIndependence of JudgmentThe degree of judgment is related to the identification and definition of new problems of advanced complexity and integration/coordination of varied elements and its application to specific subjects.Supervisory ResponsibilitiesThis position does not have any direct supervisory responsibilities; however, will be responsible for the oversight of several IT/IS stakeholders (Service providers, Business Units, IT Risk, etc.).Impact of ErrorsThe impact of errors of this position could affect other department activities or external services and strategic results or Bank image through the regulatory agencies, customers and the community. The impact of errors of this position could also affect the essential activities for the Bank, either from other divisions or departments, or within.Competencies· Exercise excellent written communication skills with direct experience drafting guidance documentations· Understand complex business and Information Technology / Information Security processes· Familiarity with vulnerability assessment and penetration testing best practices· Understand and be proficient in common cyber threat terminology, methodologies, possess basic understanding of cyber incident and response, and related current events· Knowledge in databases, Web Applications, Network and communication Infrastructure, operating systems (ex. IBM, Unix, Linux and Windows), security technologies (firewalls, IDS/IPS, etc.)· Knowledge of the application firewall concepts and functions (e.g., Single point of authentication/audit/policy enforcement, message scanning for malicious content, data anonymization for PCI and PII compliance, data loss protection scanning, accelerated cryptographic operations, SSL security, REST/JSON processing).· Knowledge of the enterprise information technology (IT) architectural concepts and patterns (e.g., baseline, validated design, and target architectures.)· Strong working knowledge of Information and System Security, internal control frameworks such as: COBIT, ISO 27000, NIST, etc.· Understanding of Information Technology knowledge within the Banking Industry· A strong understanding of Information Security regulatory requirements and compliance issues, previous experience with applicable regulations from the FDIC, FFIEC, SOX, etc.· Capable of working with minimum supervision· Strong analytical skills and problem-solving skillsPhysical DemandsThe physical demands described here are representative of those that must be met by an employee to successfully perform the essential functions of this job. Reasonable accommodations may be made to enable individuals with disabilities to perform the essential functions.Specific vision abilities required by this job include close vision and distance vision. While performing the duties of this Job, the employee is regularly required to sit; use hands to finger, handle, or feel and talk or hear. The employee is occasionally required to stand and walk.Work EnvironmentEmployees in this job work in an office environment with a comfortable room temperature, good lighting, and quiet conditions. May be required to travel and work extended hours, including holidays, should these coincide with risk mitigation and/or evaluation efforts of other projects/implementations.Minimum Requirements· A Bachelor's Degree in Information Technology, Computer Science, engineering, or business is required for this position.· The incumbent must have at least 7 years of Information Security experience or experience on a similar position within the Banking Industry.· CISSP, CISM or any other similar certification is highly desired but not required.· A master's degree in computer science, information systems, engineering, or MBA is desired but not required.DisclaimerThe above statements are intended to describe the general nature and level of work being performed by people assigned to this job. They are not indented to be an exhaustive list of all responsibilities, duties, skills required of personnel so classified. The reporting relationship may not reflect the most recent changes to the corporate reporting structure.EQUAL EMPLOYMENT OPPORTUNITY EMPLOYER
