Populus is an amazing company where our employees stay because they love their teams and the growth opportunities. Additionally, we offer a competitive 401K match, a generous paid time off package, and Health Benefits. Our mission is to provide a broad range of quality financial products and services delivered with best-in-class customer service. We work and lead with integrity, and we celebrate employees who exemplify our values. Come join our team!

The Information Security Engineer I is responsible for securing the environment using new and existing technology to monitor, assess, and mitigate internal and external risks to the company’s network infrastructure and business applications. Our network and applications handle millions of transactions annually in our 900+ stores nationwide, as well as a significant ecommerce business. We are looking for a highly motivated, hands-on information security professional to join our Security Team.

Major Responsibilities

• Create and review information security plans and policies.
• Possess the ability to proactively audit technical environments. The successful candidate will be able to locate areas that do not follow best practices, pose potential security risks, and suggest recommendations for remediation.
• Monitor networks/systems using event detection tools and perform incident response investigations through proactive action, delivering clear communication, and planning an effective resolution.
• Perform routine network and application-level vulnerability scans as required by the organization.
• Implement vendor supported and open-source tools to assist in detection, prevention, and analysis of security threats.
• Use general business knowledge and technical experience to execute various tasks and consult and recommend improvements to information security operations.
• Help improve the organizations overall security posture by applying basic analytical, problem solving, and decision-making skills with a service focused attitude.
• Assist with hands-on support for a wide range of security technologies including, but not limited to: SIEM, IDS/IPS, HIDS, malware analysis and protection, content filtering, logical access controls, identity and access management, data loss prevention, firewalls and content filtering technologies.
• Participate in the planning, implementation, and ongoing management of data security related tools and projects, collaborating with operations and data intelligence teams as necessary.
• Provide hands-on technical support to InfoSec team working directly with delivery teams to provide guidance and ensure solutions adhere to security policy and best practices.
• Support applications, infrastructure, operations, and security teams as needed.
• Partner with InfoSec tool leads to enforce security and IT policies.
• Assist with the writing of comprehensive reports including assessment-based findings, outcomes, and propositions for further system security enhancements.

Key Competencies

• Analytical
• Troubleshooting
• Technical
• Project Management
• Focused
• Detail Oriented
• Communication, verbal and written
• Problem Solving
• Time Management
• Teamwork (place priority on the successful completion of team and company goals).
• Quick thinking/learning
• Multi-tasking, organization, and administrative skills
• Self-starter with a high degree of initiative and a strong ability to meet deadlines
• Highly motivated and work effectively under minimal supervision
• Responsibility and accountability

Minimum Qualifications

• Bachelor’s degree in computer science, Information Systems (or related field of study), or equivalent work experience in IT.
• 1 to 3 years in Information Security role(s).
• Must be able to perform a basic assessment of internal and external threats to the organizations security posture and recommend reasonable improvements to procedures and/or technologies to mitigate risks.
• Must have basic experience running investigation searches using a SIEM and configuring new log monitoring rules as required by the needs of the organization.
• Analyze the result output from infrastructure and web application vulnerability scans and consulting system owners on remediation.
• Preferred candidate will be seeking at least one or more technical security certification
• Preferred candidate will have or plan to obtain at least one more professional security certificate (CompTIA Security Plus, CISSP, CISM, CEH, SANs)
• Have a basic understanding of information security policies and common cyber security controls and architectures.
• Can perform basic auditing of security configurations for Windows and Linux operating systems including Active Directory.
• Can use Office365 Security tools to assess and report security information
• Possess a general understanding for assessing and securing network controls (i.e., firewalls and network appliances).
• Possess a general understanding of Intrusion Prevention Systems and web security services/appliances.
• Experience working with intelligent edge platforms that provide a secure web application firewall (WAF) for front-end applications including mobile.
• Ability to assist teams with assessing and implementing security controls for web and mobile applications including methodologies and approaches to dynamic and static application secure code testing.
• Ability to support the team with conducting internal and external vulnerability management testing and managing pen testing engagements using third-party vendors.
• General understanding of IT Control frameworks, security standards and regulations (ISO27001, ITIL, NIST, PCI DSS). PCI-DSS experience preferred
• Must be highly proficient with Visio, Project, Word, Excel, PowerPoint, and Outlook

Technical Experience & Other Skills

• Must be able to use vulnerability scanning platforms from a DSS approved scanning vendor (ASV). Preferably Nessus or Tennable.io.
• Experience using or general knowledge around Endpoint Detection and Response tools. Preferably CrowdStrike.
• Experience using or general knowledge around Data Loss Prevention tools. Preferably Forcepoint DLP.
• Experience using a SIEM to monitor centralized security logs. Preferably using Elastic Search products.
• General knowledge of IAM tools to manage and perform ongoing assessments through automation. Preferably using ManageEngine products.
• Standard proficiency with technologies used for routing, switching, and subnetting. Preferably using Fortinet products. Experience with F5 or Netscaler is a plus.
• Baseline experience working with Microsoft Active Directory and Group Policy security best practices to improve security. Preferably using CIS benchmark standards.
• Experience or basic understanding of Office365 Security and Compliance applications and features.
• Ability to configure local security on Windows 10, Windows Server 2012/2016/2019, Red Hat Linux operating systems and MS SQL databases. Additional knowledge with IBMi AS/400 Security, Nutanix, DB2 and/or Netezza DB is a plus.
• Basic understanding of common network protocols and ports: UDP/TCP, DNS, SSL, TLS, HTTP/HTTPS, FTP, SSH, etc.

Physical Demands

The physical demands described here are representative of those that must be met by an employee to successfully perform the essential functions of this job. Reasonable accommodations may be made to enable individuals with disabilities to perform the major responsibilities.

While performing the duties of this job, the employee is regularly required to sit, stand or walk; use hands to finger, handle, or feel; reach with hands and arms; stoop or bend; and talk or hear. The employee must occasionally lift and/or move up to 50 lbs.

Position Type/Expected Hours of Work

This is a full-time position. Days and hours of work are Monday through Friday, 8:00 a.m. to 5 p.m. This position might require long hours and weekend work.

Work Environment

The work environment characteristics described here are representative of those an employee encounters while performing the essential functions of this job. Reasonable accommodations may be made to enable individuals with disabilities to perform the essential functions. The noise level in some work environments can be moderate.

Disclaimer

The above information on this description has been designed to indicate the general nature and level of work performed by employees within this classification. It is not designed to contain or be interpreted, as a comprehensive inventory of all duties, responsibilities, qualifications required of employees assigned to this job.

EEO Statement

Populus Financial Group provides Equal Employment Opportunity (EEO) to all employees and applicants for employment and prohibits discrimination and harassment of any type without regard to race, color, religion, age, sex, national origin, disability status, genetics, protected veteran status, sexual orientation, gender identity or expression, or any other characteristic protected by federal, state or local laws. This policy applies to all terms and conditions of employment, including recruiting, hiring, placement, promotion, termination, layoff, recall, transfer, leaves of absence, compensation and training.