City of Hope Senior Manager - Information Security in Irwindale, California
Job Title: Senior Manager - Information Security
ABOUT CITY OF HOPE:
City of Hope, an innovative biomedical research, treatment and educational institution with over 4000 employees, is dedicated to the prevention and cure of cancer and other life-threatening diseases and guided by a compassionate, patient-centered philosophy.
Founded in 1913 and headquartered in Duarte, California, City of Hope is a remarkable non-profit institution, where compassion and advanced care go hand-in-hand with excellence in clinical and scientific research. City of Hope is a National Cancer Institute designated Comprehensive Cancer Center and a founding member of the National Comprehensive Cancer Network, an alliance of the nationâ€™s 20 leading cancer centers that develops and institutes standards of care for cancer treatment.
POSITION SUMMARY & KEY RESPONSIBILITIES:
The Sr. Manager, Information Security oversees a team and performs technical and operational tasks to design, develop, implement and maintain information security solutions using technologies and processes to uphold the confidentiality, integrity and availability of City of Hopeâ€™s information assets. Conducts engineering design of hardware and software systems to ensure security controls are properly integrated, defines monitoring and audit protocols, assess network traffic and system use patterns to identify security events. Executes effective countermeasures to current threats to systems and networks. Leads engineering projects to implement information security strategies and provide operational governance to the Information Security team in administration of security platforms.
- Manage the operational administration of information security applications, network systems, and third-party platforms.
- Assess network architecture, system and application design to ensure security control principles are effectively implemented. Evaluate compliance with regulatory requirements and business requirements including, but not limited to, HIPAA, HiTECH , PCI guidelines and City of Hope policies, standards, and procedures.
- Manage engineering effort and implementation of the information security strategic roadmap.
- Leads forensic analysis of security violations.
- Facilitate control testing, vulnerability assessment, risk assessments, penetration and social engineering testing. Manage remediation effort to correct identified weaknesses.
- Perform assessment of standard base configurations for network devices, server platforms and workstation systems. Regularly audit configurations for compliance and escalate exceptions.
- Lead the design, development and implementation of security related technologies and architectures, such as, but not limited to, Security Incident and Event Management (SIEM) platforms, Intrusion Prevention/Detection systems (IPS/IDS), virtual private networks, endpoint security, access and identity management systems, access control, network segmentation, data loss prevention tools, firewall architectures, proxy servers, internet access policy servers, and content screening servers.
- Document security infrastructure design and operational procedures.
- Identify and propose solutions to enhance City of Hopeâ€™s information security profile.
- Define performance measurements (including service level and operating level agreements) for information security related products in service.
- Actively participates in the development of the information security program. This includes providing guidance to the development of the strategic roadmap, forensic studies, metric definition, monitoring metrics and incident handling.
- Manages and develops a team of engineers that are tasked with working on IS security projects across the COH enterprise.
- Represents the IS Security Engineering in internal COH meetings.
- Perform special projects as assigned by the CISO.
- Internal Contacts: Across all VP/Director/Managers, ITS departments, COH financial and administrative business, BRI/research areas, Division of Information Sciences, Population Sciences, etc., all COH clinical areas, the COH Graduate School and external vendors related to Information Security.
- External Contacts: Software/hardware vendors related to Information Security.
- Budget/Financial Administration: Financial tracking and status reporting on assigned project efforts.
Minimum Education and Experience:
- Bachelorâ€™s Degree (Masterâ€™s degree preferred).Experience may substitute.
- Over10 years in a technology related field
- 5 years administration of electronic communication platforms (e.g., Microsoft Exchange/ O365), WAN and telecommunication architecture (e.g., MPLS, Cisco Call Manager, VPN), database platforms and web-based systems
- Cross-platform engineering, implementation and administration of network routing and firewall architectures, encryption technologies, security incident and event management (SIEM) platforms, identity and access management systems, intrusion prevention/ detection devices (IPS/IDS), vulnerability detection tools, data loss prevention systems, multi-factor authentication, network admission control and endpoint security systems.
- Comprehensive knowledge of information security principles, including understanding of risk assessment principles, control frameworks (e.g., CobIT, ISO 27000) and regulatory guidelines (HIPAA, HiTECH, PCI-DSS).
- Understanding of incident handling procedures and technology recovery principles.
- Facilitation of information technology audits, incident handling, vulnerability and penetration testing.
- Electrical Engineering, Computer Engineering, or Computer Science
Preferred Certification / Licensure:
- CISSP â€ Certified Information Systems Security Professional
- CISM â€ Certified Information Security Manager
- Advanced network platform certification such as Cisco Certified Network Professional (CCNP)
- Vulnerability and penetration testing certification such as Certified Ethical Hacker (CEH)
Any GIAC certification:
GISP â€ Information Security Professional, GSEC â€ Security Essentials Certification, SSCP- Systems Security Certified Practitioner, GISF- Information Security Forensics, CBCP (Certified in Business Continuity Planning) CISCO certifications
- PMI PMP â€ Certified Project Management Professional
Software / Hardware:
- Security Incident and Event Management systems (SIEM)
- Identity and Access Management solutions
- Log monitoring, event collection and correlation software
- Vulnerability Management tools
- Database vulnerability and monitoring tools
- VMware (virtual machine software)
- Encryption software
- Anti-malware and anti-virus detection software
- VPN Technologies
- Unix/Linux OS
- Microsoft Windows Server and Desktop Operating Platforms
- Microsoft Exchange
- Network Analysis Software
- Routers / Switches
- IIS, HTTPS, SSL, SSH, POP3, DNS, FTP
- Snort, Nmap, Snoop, Tcpdump, Wireshark
City of Hope is committed to creating a diverse environment and is proud to be an equal opportunity employer. All qualified applicants will receive consideration for employment without regard to race, religion, color, national origin, sex, sexual orientation, gender identity, age, status as a protected veteran, or status as a qualified individual with disability. #LI-DA1 | *CB-DA dice