IS Security Engineer III – 15854329 Contract

Job Title:  IS Security Engineer III

Location:  Philadelphia, PA / 80% Remote

Duration:  Contract

Responsibilities:

An Information Security Specialist III is a senior contributor with similar responsibilities as the Information

Security Specialist II, but with a great degree of complexity. An Information Security Specialist III may be involved

in some leadership activities. An Information Security Specialist III also:

• Exhibits proven technical knowledge in multiple information security disciplines (access control,

monitoring, GRC), and industry standards frameworks, and security operations models.

• Exhibits proven technical knowledge in multiple security engineering disciplines and understands different

firewall architectures.

• Demonstrates proficient skills in designing, implementing information security solutions, risk

management platforms, and providing input on information security strategic plans.

     -> Provide leadership support to IS teams around security initiatives.

      ->  Proven knowledge of security applications such as intrusion detection systems and forensics packages.

1. Defines and documents information security principles and processes to assist enterprise solution

architects in security decisions for the enterprise, including access control, security information and

event monitoring, and data loss prevention, perimeter (e.g., firewalls, IPS, web filtering) and network

security (host-based firewalls, anti-virus, disk encryption).

2. Develops, builds, tests deployment strategies for information security solutions for application

development as part of the organizations System Development Life Cycle (SDLC) methodologies.

3. Defines and documents system security and compliance requirements in support of approved PMO

projects, existing operational activities, trace all system security and compliance requirements, validates that

requirements are addressed, including validation of the final detailed security design specifications to

support PMO life cycle activities.

4. Performs analysis and fulfills requests of eDiscovery & forensics investigations independently by

collecting evidence and maintaining chain of custody of records.

5.Participates as a member of the Hospital CERT team and performs various security information and event

management procedures to support security investigations.

6. Participates on related InfoSec standards for business continuity and change management

activities (e.g., table tops and change review board) and educates IS Hospital management on

security issues (e.g., PCI, Identity and Access Management (IAM), Role Based Access Control (RBAC)

models

7. Reviews periodic risk analysis and risk assessment activities in support of regulatory requirements (e.g.,

HIPAA Security & Privacy Rules, PCI DSS, and Joint Commission) utilizing established Governance

Risk Compliance (GRC) technology or customized solutions.

8. Facilitates analysis of information security issues and recommends solutions for remediation.
9. Meets with clinical and business units to determine specific security requirements for application

development & validate that requirements, documentation, design, and build are complete and accurate

for application level development projects.

10. Supports Client IS capital budget planning process.

Information Security Requirements:

1. Understand and comply with all enterprise and IS departmental information

security policies, procedures and standards.

2. Support the integration of information security in the development, design, and

implementation of Hospital Technology Resources that process, transmit, or store

Client  information.

3. Support all compliance activities related to state, federal regulatory requirements,

healthcare accreditation standards, and all other applicable regulations that govern the

use and disclosure of patient, financial, or other confidential information.

Additional Techincal Requirements:

1. Comprehensive know of information security regulations, standards and leading

practices, including understanding of EHR application access controls.

2. Good knowledge of basic database query techniques & data mining to analyze data

(e.g., Excel, SQL, Quickbase, Business Objects) or other related database

functionality.

3. Knowledge of MS Active Directory, UNIX, and Clinical Applications a plus.
4. Experience implementing application level security in clinical and financial

systems (e.g., Epic, Lawson). ERP experience a plus (PeopleSoft, SAP).

5. Understands different firewall architectures (packet filter, application firewalls,

application proxy, and VPN) and brands (Checkpoint, Cisco)

6. General understanding of networking and communication techniques including WANs,

LANs, Internet, Intranet, protocols, such as TCP/IP and their impact on security.

7. Some knowledge of security applications such as intrusion detection systems and

forensics packages (EnCASE), ArcSight, Foundstone

8. Understands differences in perimeter and DMZ architectures & experience with

industry standards with system architectures including various UNIX and Microsoft

Windows server and desktop platforms.

9. Has experience with application layer formats, usage and characteristics (HTTP, FTP,

SSH, DNS, SMTP). Has knowledge of system architecture and design.

10. Microsoft, UNIX, Lawson, and Clinical Applications (e.g., Epic).
11. Experience with industry standard SDLC methodologies; hands-on experience in

Project Server methodologies, PMO project management skills, including use of MS

productivity tools (Access, Word, PowerPoint, Visio, Project).

12. Experience with risk management frameworks.”

Education:   

“Licenses/Certifications:

1. Industry security certification required such as HealthCare Information Security and

Privacy Practitioner (HCISPP), Certified Internal Auditor (CIA), Certified

Information Systems Security Professional (CISSP), Certified Information Systems

Auditor (CISA), Certified Information Security Manager (CISM), Certified in the

Governance of Enterprise IT (CGEIT), Certified in Risk and Information Systems

Control (CRISC) or other industry related certification a plus.

Education and Experience:

1. Bachelor’s degree in Computer Science, Information Systems, or related field

required.

1. 5 – 12 years related work experience; 4+ years of experience with information security,

regulatory compliance and risk management concepts

2. 3 years of security architecture/engineering required
3. Comprehensive understanding of InfoSec risk management concepts, security

engineering principles & practices, (e.g., COBIT or NIST).

3. Demonstrates a basic knowledge and understanding of Information security

principles, System Development Life Cycle (SDLC), general and IT controls, security

engineering principles, and related information security policies and procedures.

4. Exhibits knowledge of industry regulatory standards and accreditation

requirements (HIPAA, PCI, and Joint Commission).”

Thanks and Regards

Rajeev Kumar
Lead Recruiter
(7183600611)

420 Lexington Ave, 30^th FL. • New York, NY 10170

#LI-RK1