SR. Security Engineer- Governance and Compliance

About The Position
A Senior Security Engineer-Governance and Compliance works closely with colleagues in Information Technology, as well as with internal audit, compliance and other key stakeholders to develop information security strategies and build related programs that enhance the University’s ability to protect the confidentiality, availability and integrity of its information assets, including customer information. An individual serves as lead for implementing and configuring security tools within the University’s technology space, including implementing the framework for security standards and compliance of systems, infrastructure, cloud technologies and solutions or Identity and Access Management (IAM). Additionally, an individual contributes to enterprise-level policies and standards, leads incident response activities, and security issue remediation.
What You'll Do
Lead efforts to implement and configure security tools within the University’s technology space to protect its information assets, including customer assets; collaborate with information security peers and management to ensure various platforms, such as Azure, AWS, Private cloud, SaaS applications, are compliant and meet the University’s information security standards and regulatory requirements.
Monitor and recommend changes in strategies and standards that affect Information Security, especially in the area of privacy and identity theft; proactively assess potential items of risk and vulnerabilities in cloud technologies and applications or IAM; establish and provide security governance during the systems development lifecycle, construction, and maintenance of cloud or IAM technologies and solutions using DevOps, DevSecOps, and Agile development methodologies.
Identify opportunities to improve risk posture, develop solutions for remediating or mitigating risks and assessing the residual risk. Communicates risk findings to Information Security customers and business partners; develop remediation plans and coordinate with appropriate service, application, and technology owners through the completion of those plans, as appropriate.
Evaluate existing Information Security standards and updates according to technology advances, changes in business process and threat landscape; adjust existing Information Security standards to align with leading cloud and/or IAM security practices and technologies.
Hands-on experience with designing, implementing, and managing IAM and/or cloud solutions while overseeing user access provisioning, deprovisioning and role-based access controls (RBAC)
Maintain detailed working knowledge and awareness of concepts within the following: Identity & Access Management (IAM), Access Controls, Authorization, Encryption of data at rest / in transit, multi-factor authentication, SAML, Single-Sign-On, Social Sign On, web application firewalls, etc.
Work collaboratively across cross-functional teams to integrate IAM and/or cloud solutions and services; maintaining runbooks for cloud and/or IAM workflows and processes.
Able to provide support after normal business hours, as needed.
Perform other duties as assigned or apparent
NOTE: The Primary Accountabilities above are intended to describe the general content and requirements of the position and are not intended to be an exhaustive statement of duties. Incumbents may perform all or most of the Primary Accountabilities listed above. Specific goals or responsibilities will be documented in incumbents’ performance objectives as outlined by the incumbents’ immediate manager.
Supervisory Responsibilities
None
Minimum Education And Related Work Experience
Bachelor’s degree in Computer Science, Business, or related area
Ten (10) years of progressive experience in Information Security related roles with at least Six (6) years of hands-on experience
Security related certifications e.g., CISSP, CISM, CISA
Additional Qualifications
Ability to align compliance regulations (SOX, GLBA, etc.)
Experience with being an audit liaison and support
Experience with controls documentation and accuracy
Experience with vendor management
Experience with legal contract support
Experience with simplified artifacts retrieval
Ability to QA process for validation of evidence before providing
Cybersecurity Insurance
Experience with automation of evidence collection and process
Able to provide support after normal business hours as needed
Industry recognized certifications specific to IAM (e.g. Certified Identity and Access Manager, Identity and Access Administrator Associate, etc.)
Working knowledge of industry frameworks related to information security (e.g. ISO 27000, NIST, etc.)
Experienced in network and Security components, including firewalls, intrusion detection systems, anti-malware products, e-Discovery and forensics tools and products, IT Risk Management methodologies, data encryption, VPN's, vulnerability scanners, multiple operating systems (Windows, UNIX, Linux, etc.), cloud security groups, and directory services (Active Directory, LDAP)
Subject Matter Expert (SME) level knowledge of security tools, trends, methodologies, and best practices for securing platforms and operating systems at the server, client, and handheld level
Expert knowledge of information security risks and countermeasures for Windows, Unix/Linux platforms and cloud environments
Experience with principal and policy-based security design methodologies with understanding of IaaS, PaaS, and SaaS models
Able to create and manage Security solutions with a high degree of integration
Strong understanding of regulatory requirements (PCI, SOX, GLBA) and how they impact information security functions
Demonstrated ability to work effectively in a collaborative team environment as an individual contributor
Strong business analysis skills
Able to learn quickly, absorb and retain information, and apply knowledge when and where relevant
Self-motivated and able to work on own initiative with minimal guidance and a desire to see tasks through to completion
Experience managing a varied and heavy workload
As an Equal Opportunity employer, we particularly encourage applications from members of historically underrepresented racial/ethnic groups, women, individuals with disabilities, veterans, LGBTQ community members, and others who demonstrate the ability to help us achieve our vision of a diverse and inclusive community.
If you are an active-duty military member seeking employment when off-duty, compliance with Department of Defense Joint Ethics Regulation, 5500-7-R, is required prior to starting employment with University of Phoenix. You are advised to contact your base Judge Advocate General to seek such approval and answer any questions.

Work arrangement
Yes