Information Security Specialist (Harvard University) [ARCHIVED]

FAS IT

Duties And Responsibilities:
Reporting to the Director of Information Security, the Information Security Specialist will assist in the development and implementation of the FAS Information Security and Compliance monitoring program. Working with FAS departments, will perform network penetration tests, application vulnerability assessment scans and risk assessment reviews, serve as technical lead of the computer security incident response team, and analyze security events. Will assist FAS IT support staff implement best practice Information Security standards. Perform network penetration tests and application vulnerability assessments, validate findings, draft management reports and manage the remediation process. Responsible for Leading risk assessments of FAS systems and data for risk and policy compliance and draft Risk Assessment management reports. Provide advisory service on all IT projects to ensure compliance with Harvard University policy and FAS standards. Document procedures for performing responsibilities, and cross train Information Security staff. Act as technical lead during Information Security incidents for the FAS. Test FAS department compliance with Harvard University and FAS policy and draft Compliance reports. Monitor security event log data, and report suspicious activity to the Director of Information Security. Identify and understand potential threats, vulnerabilities, and recommend control techniques. Investigate security breaches and report findings to management. Enforce Information Security and Privacy policies in compliance with federal and state regulations and standards as well as Harvard University-wide requirements. Work with FAS architects and engineers to design security controls into new infra-structure initiatives. Support requests to provide forensic data in all sanctioned investigations.

Required Education, Experience and Skills:
BA or BS in Computer Science, Information Management, or equivalent experience. 5-7 years of progressive experience in computing and information security, including experience with Internet technology and security issues. Strong interpersonal and written communication skills. Understanding of ISO/IEC 27002, PCI Data Security Standard, Gramm-Leach-Bliley Act, Sarbanes-Oxley Act, Health Insurance Portability and Accountability Act, various state and federal non-public personal information data protection regulations, and the COBIT framework. Ability to develop project plans and manage cross-functional projects. Experience should include working in a risk-based security program, network penetration testing, application vulnerability assessments, risk analysis and compliance testing. Working knowledge of TCP/IP networking and routing, Perl, Unix Shell or Windows scripting, Firewall principles, UNIX and Windows server operating systems, encryption/authentication technologies, security services involving networks, firewalls, web servers, DNS administration, LDAP and Relational Database systems, vulnerability assessments. CISSP or other security certification. GIAC certifications desired. Higher education, governmental agency or industry information security experience.

Additional Information: All Formal offers will be made by FAS Human Resources.