Information security (IS) engineers

Information security (IS) engineers will collect, review, evaluate and interpret data; diagnose normal and abnormal patterns; develop and implement security rules and policies; diagnose and troubleshoot problems; solve problems; and design and implement solutions based on security principals, best practice and existing technologies. Engineers may also configure, maintain and install equipment; develop or modify source code; write scripts; harden or secure applications or databases; or respond to and resolve information security incidents depending on their area of specialty. All engineering specialties may also plan, implement, evaluate, review and status projects involving information security solutions in their specialty area. They document their work or the work of others on their projects.

Engineers must be able to clearly communicate and escalate problems, issues and solutions to technical and non-technical audiences alike using verbal, written and graphical communication. They must be able to work on interdisciplinary teams to develop solutions that are integrated across organizational and functional lines.

Duties:

Primary job duties include the following:

●Address security risk assessment findings and recommendations for two key systems, Colorado Benefits Management System (JAVA, Linux, Oracle) and PEAK (force.com platform)

●Assist the state with updating processes and procedures in support of security plans for Federal Agencies (Social Security Administration, CMS and IRS)

●Provide recommendations for software and hardware configurations to support security standards and setting up a HW/SW asset license management system.

●Assist the state with planning the migration of one major system to new hardware and implementing the required controls.

●Participate in the definition and implementation of projects to upgrade the systems and infrastructure to comply with revised standards for security and privacy, including MARS E v 2.0 for CMS and publication 1075 for IRS and management of FTI data.

●Recommend changes to the process for planning and validating the application of patches.

●Assist with the implementation of a Governance, Risk Compliance (GRC) tool

●Review application code and operating system vulnerability scans and oversee remediation