*Job Description*
This position provides Information Security support, governance and consulting services for facilities enterprise wide. This position will also assist in driving continuous improvements in all aspects of the company’s Information Security program. With a special focus on application security (Web & Mobile), penetration testing, end point security (PC & Mobile) & Infosec awareness programs.
Lead the Application Security assessment related activities
· Perform application vulnerability assessments of Eaton Applications. (Web based + Mobile based).
· Perform penetration testing using both automated and manual techniques.
· Review Automated Scan reports and filter out false positives before reporting.
· Testing Applications for Business Logic Security flaws.
· Work closely with Business owners, technical contacts, Solution architects, Developers and functional management in prioritization and remediation of Security issues.
· Provide solutions that effectively & efficiently remediate Security issues discovered in various Applications by leveraging latest security features in various products, frameworks, languages etc.
· Provide Application Security training on Secure Coding practices to developers across various teams.
· Manage & execute the Web Application Scanning process.
· Maintain scorecards for tracking the progress of remediation of vulnerabilities.
· Contribute to the process improvements for Eaton web application security program.
· Contribute to the deployment of Secure SDLC. Design security measures / artifacts throughout the software application life cycle and provide consulting and training to project managers, business analysts and software developers.
· Administration/ Optimization of the scanning tools.
Lead the Application penetration testing activities during a Security Incident.
· Ascertain security loopholes that could’ve led to the security incident
· Review operational and exception logs to determine the cause of security-related events.
· Work closely with Eaton CIRT team to get the Security issues remediated and help the business quickly restore their Business Applications.
Execute Infrastructure vulnerability management program:
· Perform host vulnerability scans
· Work with platform teams and functional management in prioritization and remediation of vulnerabilities.
· Provide effective solutions to the System Administrators to harden the hosts.
· Perform manual vulnerability assessments of hosts.
· Contribute to the scorecards for tracking the progress of remediation of vulnerabilities.
· Contribute to the process improvements for vulnerability management program.
Administration/ Optimization of the scanning tools / platforms.
Execute End-point security & compliance related activities
· Conduct security risk assessment of Endpoints. Design, implement & monitor appropriate security controls.
· Independently review Local Administrator Rights exception requests and take a decision.
· Work on IT Copyright Compliance program.
· Contribute in process improvements of the above programs
Execute IT Security reviews to ensure compliance with company policies and standards, ensure business information, electronic and intellectual property is reasonably safeguarded, and provide security-related training as appropriate.
· Participate in IT, Engineering & Intellectual Property, 3rd party service providers security risk assessments
· Assist resource owners and IT staff in understanding and responding to security audit failures reported by internal and external auditing departments.
Train information owners, Application developer and others in the implementation of necessary computer security controls or new upgraded security software and devices -- conducting awareness seminars and workshops as appropriate.
Appraise IT Security management of security-related incidents.
Participate in the research, evaluation, design, testing, recommendations and planned implementations of new technologies, improved information security procedures, software and devices -- analyze new or enhanced software applications or tool implementations for existing security software and devices. Provide technical expertise and guide the administration of security tools that control and monitor information security, including update access control tables, set-up and de-commissioning of user log-on ID's, assigning/resetting passwords, and monitoring system access reports to identify possible security violations.
Proactively protect the integrity, confidentiality, and availability of information and intellectual property in the custody of, or processed by, the company. Respond in a timely manner to a loss or misuse of information assets. Identify existence of securable resources and assist management in selecting the appropriate resource owner. Work with these resource owners in organizations to determine appropriate security policies for securable resources. Communicate unresolved security exposures, misuse, or non-compliance situations to IT Security management.
Advise security administration staff on normal and exception processing of security authorization requests.
Assist in IT Security due diligence related to acquisitions, divestitures & joint ventures. This includes assisting the global IT Security staff with implementing and enforcing security policies and performing vulnerability scans for sites being acquired or divested.
Assist in confidential security, legal, and ethics investigations, including preservation and collection of electronic evidence for forensics analysis.
* Basic Qualifications (Including Educational Requirements)*
1. Excellent oral and written English communication, Collaborative, Interpersonal skills.
2. Advanced level proficiency in Network Vulnerability Assessment & Penetration testing tools (2-3 tools from this list)– Qualysguard, NeXpose, Nessus, Metasploit, Core Impact. IBM Appscan & other Open Source tools is required
3. Advanced level proficiency in Application Vulnerability Assessment & Penetration testing tools (2-3 tools from this list) – IBM AppScan, HP Web Inspect, Qualysguard WAS, Zed Attack Proxy, Burp Suite, Kali Linux, BeEF, SQL Map, Havij etc. Threat Modelling tools (MS-Threat Modeling Tool, ThreatModeler).
4. Knowledge of conducting Source Code reviews for Identifying Security Loopholes. Proficiency in at least 1 tool like HP Fortify, AppScan Source Edition, VeraCode, Chekmarx etc.
5. Knowledgeable of Application Threat Modeling methodologies and ability to lead threat modeling activites.
6. Proficiency in execution & management of Penetration testing assignments.
7. Well versed with Information Security risk assessment procedures, role-based authorization methodologies, authentication technologies, and security attack pathologies. Familiarity with policy formation and Information Security management process.
8. Strong skills in MS-EXCEL, MS-ACCESS, VBScripting, MS- Sharepoint. Proven ability in automating manual tasks.
9. Experience of working in Large IT setups. Knowledge of the following technology (examples not exclusive):
* Web Technologies: Microsoft IIS, Apache, SunOne Portal, BEA WebLogic, IBM WebSphere, Oracle HTTP Server, SQL, XML, JAVA, SOAP, SIMPLE, SIP, SAML, WS-Security, CITRIX
* Servers: HP-UX, RHEL, Windows 2003, 2008
* Databases: Oracle, Progress, SQL Server, DB2
* Programming Languages/Environments: JAVA, .NET, PHP, C, C++ , PERL, Shell scripting, HTML 5
* Networking and Encryption: TCP/IP, Ethernet, 802.11x, Routers, Firewall, SSL, DMZ, VLAN, VPN, NAT, RADIUS, PAM, NTLM, CHAP, PPP, Proxies, SMTP, SNMP, PKI, SSH, RSA SecurID, S/MIME, TLS, PGP, Zixmail, Antivirus (Trend).
* Desktop: Windows 200x, Windows XP, NT & 9x, Microsoft Office Suite, Microsoft Outlook/Exchange, Antivirus (Trend)
1. Ability to relate business requirements and risks to technology implementation for security-related issues.
2. Ability to effectively adapt to rapidly changing technology and apply it to business needs.
3. Strong knowledge and understanding of business needs, with the ability to establish and maintain a high level of customer trust and confidence in the security team's concern for customers.
4. Proven ability to work under stress in emergencies; flexibility to handle pressure coming from all directions, simultaneously.
5. Strong analytical and problem-solving skills, customer focus and ability to manage client expectations.
6. Confidence and leadership as a member of project teams in a cross-functional environment.
7. Project management skills, especially in a cross-functional global environment.
8. Knowledge of ISO 27001, PCI-DSS, SOX requirements is required.
9. Possessing any of the following certifications – GWAPT, GSSP (.Net / Java), GWEB, CSSLP, GPEN, CEH, ECSA, LPT, CISSP, ISO27001, ITIL V3, Security product certifications like IBM Certified Specialist – Rational AppScan Standard Edition, Qualysguard Certified Specialist or any other Security / Risk management certifications would be an added advantage.
10.
1. Bachelor's degree in Computer Science, Engineering, or related discipline; equivalent experience acceptable.
2. Five to Seven years of experience in one or more of the following areas:
o Multi-platform technical/security.
o Leading Application and Infrastructure Vulnerability Assessment program/ project
o Penetration testing
o Data administration or experience in various database design techniques.
o Application development (Client-server, Web based, Mobile) and secure programming techniques.
o Threat Modelling
1. Experience with Internet technology and remote access control systems (e.g. IP, Analog and WiFi).
2. Working Knowledge of government security regulations and guidelines, in particular regarding Sarbanes Oxley Act, HIPAA and DMCA, U.K. Export Control Regulations, EU Privacy regulations, etc . Other regulations like PCI-DSS.
3. The following qualities or experiences are strongly desirable:
o Quick Learner & Adopter of new technologies.
o Excellent presentation skills specially in a multi-cultural settings comprising audience from varying seniority levels.
o Experience of manual penetration testing.
o Advanced level knowledge of MS Excel, MS- Access, MS-Sharepoint, VB Scripting
o Proven track record in developing effective solutions to diverse and complex business problems.
Eaton is a global technology leader in power management solutions that provides energy-efficient solutions that help our customers effectively manage electrical, hydraulic and mechanical power more efficiently, safely and sustainably. Eaton has more than 100,000 employees and sells products to customers in more than 175 countries. At Eaton, we see things differently. We see opportunities to innovate, go above and beyond, and we work hard because what we do reflects who we are. If you see things differently—if you’re determined, motivated and focused on improving the world around you—then it’s time to see where a career at Eaton can take you. For more information, visit www.eaton.com/careers. Eaton is an Equal Opportunity and Affirmative Action Employer. Eaton is committed to ensuring equal employment opportunities for all job applicants and employees. Employment decisions are based upon job-related reasons regardless of an applicant's race, color, religion, sex, sexual orientation, gender identity, age, national origin, disability, marital status, genetic information, protected veteran status, or any other status protected by law.
**JOBCOMPANY:** Eaton
**JOBTITLE:** Senior Analyst IT - Security
**JOBLOCATION:** IND-MM
**REQNUMBER:** 010032
**DIVISION:** Corporate Sector
**FUNCTION:** Information Technology