Cyber Security Engineer

• Incident response top priority, could find a SME in IR
• Cyber Sec Policy writing in alignment in NIST 2.0 Second priority in skillset
• CyberArk or Dilinea or other PAM systems
• Vulnerability management Tenable is what they use; Any experience with Tenable, Rapid7, Qualys, etc.

• Reporting, communication, documentation standpoint.
• Traceroute would be nice to have.

• NIST CSF
• Gap analysis with NIST - Being able to lead a gap analysis of 30 year old policy s.

• CyberArk or Dilinea or other PAM systems
• Vulnerability management Tenable is what they use
• Any experience with Tenable, Rapid7, Qualys, etc.
• Incident response
• Cyber Sec Policy writing in alignment in NIST and other governance standards

• Interview panel: 90 minutes via MS Teams, broken up into 3 parts
  • 2 parts technical sections based on JD and relative experience
  • 1 part STAR Behavioral Interview Model

• Strong background as a systems engineer, systems administrator, or infrastructure engineer.
• At least 2 years of direct cyber security experience for all job levels.
• At least 5 years of practical cyber security experience is strongly preferred for senior-level candidates.
• Hands-on vulnerability remediation experience in enterprise environments.
• Able to interpret scan results and translate them into actionable remediation steps for technical teams.
• Comfortable working with Windows or Linux environments.
• Can engage deeply with system engineers, network engineers, and business units on how to bring systems into a secure state.
• Experience with Tenable or Nessus is highly desirable.
• Azure experience is a plus.
• VMware is a relevant skill for the role.

• professionals who can take vulnerability findings and work with engineering teams to remediate them.
• Bringing in one level 4 resource to alleviate the gaps in their Cyber pillars below:
• (ideally all 4 but at least 2-3 is required)
• Incident management

• Vulnerability management
• PAM, Privileged Access Management
• Cyber Sec Policies

• Do not focus on SOC analysts.
• Do not focus on recent graduates.
• Do not focus on candidates whose background is primarily government information assurance, IAO, IAM, ISM, or similar compliance/policy work.
• Do not focus on auditors or compliance professionals.
• NERC CIP experience is not required.
• They are not looking for policy-heavy, audit-heavy, or entry-level cyber profiles.

• What is your IT cyber security experience?
• What is your vulnerability remediation security experience? Please explain in depth.
• Have you taken a report that shows known vulnerabilities and remediated those vulnerabilities?
• Are you hands-on from a threat hunting standpoint, or are you more focused on building cyber policy?
• What is your Privileged Access Management experience
• What is your experience with system administration or server administration?
• What is your networking engineering experience?

• The team wants a senior cyber security practitioner with at least 5 years of practical cyber security experience in a real enterprise environment.
• A candidate with a long tenure in systems administration who has more recently moved into a technical cyber security role may also be a fit.
• The role is centered on technical IT vulnerability remediation rather than SOC operations.
• The person must be able to speak credibly with IT and business units about what systems need to be secured and how.
• The goal is to bring platforms into a secure state through practical remediation guidance.
• Tenable and Nessus experience would be valuable, especially if the candidate can translate scans into remediation actions for different technical teams.

careers@tekfortune.com