Senior Engineer, CIS Security

Essential Qualifications/Experience:

·       Comprehensive knowledge of and experience with conducting security risk assessments and with the security accreditation process, including the development of the required documentation

·       Comprehensive knowledge of the principles of computers and communication security, networking, edge security and the vulnerabilities of modern operating systems and applications

·       Experience with implementation and integration of CIS Security protective measures in enterprise environments

·       Knowledge of common IT security frameworks and governance models

·       Understanding of CIS Security policies and practices in NATO or NATO member nation environment

DUTIES/ROLE:

·       Provide security accreditation support of the NISC managed CIS, with focus on edge security, both for internal operations and for Agency's customer-funded networks, and ensures the adequate level of systems/data protection in accordance with NATO CIS Security policies and directives.

·       Conduct Security Risk Assessment in support of security accreditation of NATO CIS, in particular; identify level of threats and vulnerabilities for all assets comprising NATO CIS, derive residual risks and provide risk management recommendations.

·       Contribute to the development of required documents for security accreditation (CIS Description, Security Accreditation Plan, Security Risk Assessment Report, Security Requirement Statements, Security Operating Procedures, and Security Test and Verification Plan). Seeks automated processes and proposes datasets as inputs for the development of the security accreditation documents.

·       Witness security testing, in accordance with Security Test and Verification Plan (STVP), and coordinate the execution of the remediation plans.

·       When required, coordinate the preparation and support the execution of external and internal audits and security checks.

·       When required, coordinate remediation activities for the identified security vulnerabilities in collaboration with the relevant technical leads