Lead Vulnerability Analyst

Schedule: Full-time

What You'll Do:

Under general supervision in the Office of Information Security & Privacy, evaluates current IT policies, procedures, & practices & recommends:

• Leads IT driven change effort

• Participates in &/or leads activities to achieve project tasks/meet deadline

• Monitors & evaluate the effectiveness of the enterprise's cybersecurity safeguards to ensure that they provide the intended level of protection

• Participate in the development or modification of the computer environment cybersecurity program plans & requirements

• Serves as project lead (engineer) for security projects

• Assist in developing programs, projects, goals & priorities with manager &/or supervisor

• Leads/participates in troubleshooting efforts for agency/enterprise incidents

Develops solutions design:

• Works with IT Architect staff, CIO or IT Managers to design solutions that meet the agency’s requirements

• Assists analysis of the solution design’s business case

• Authors’ portions of the solution business case

• Leads/participates in agency/enterprise incidents response efforts

Works with vendors, other specialists &/or agencies to solve integration problems:

• Plans & conducts formal mentorship & training activities for peers &/or lower-level staff via verbal instruction or technical documentation

Performs other duties as assigned

What’s in it for you:

At the State of Ohio, we take care of the team that cares for Ohioans. We provide a variety of quality, competitive benefits to eligible full-time and part-time employees. For a list of all the State of Ohio Benefits, visit our Total Rewards website! Our benefits package includes:

Medical Coverage

Quality, affordable, and competitive medical benefits are offered through the available Ohio Med plans.

Dental, Vision and Basic Life Insurance

Dental, vision, and basic life insurance premiums are free after completed eligibility period. Length of eligibility period is dependent on union representation.

Time Away From Work and Work/Life Balance

Paid time off, including vacation, personal, and sick leave

11 paid holidays per year

Childbirth/Adoption leave

Employee Development Funds

The State of Ohio offers a variety of educational and professional development funding that varies based on whether you are a union-exempt employee or a union-represented employee.

Ohio Public Employees Retirement System

OPERS is the retirement system for State of Ohio employees. The employee contributes 10% of their salary towards their retirement. The employer contributes an amount equal to 14% of the employee’s salary. Visit the OPERS website for more information.

Deferred Compensation

The Ohio Deferred Compensation program is a 457(b) voluntary retirement savings plan. Visit the Ohio Deferred Compensation website for more information.

Ohio is a Disability Inclusion State and strives to be a Model Employer of Individuals with disabilities. The State of Ohio is committed to providing access and inclusion and reasonable accommodation in its services, activities, programs and employment opportunities in accordance with the Americans with Disabilities Act (ADA) and other applicable laws.

Completion of undergraduate core coursework in computer science; 24 mos. trg. or 24 mos. exp. in computer data security either through monitoring system/network traffic for anomalous activity, systems development or controlling accessibility of data.

-Or 12 mos. exp. as Enterprise Information Security Professional 1, 69981.

-Or equivalent of Minimum Class Qualifications For Employment noted above.

Job Skills: Cybersecurity, Information Technology, Problem Solving, Critical thinking

Knowledge:

1. Vulnerability Management

2. Content development

3. Different classes of attacks (e.g., passive, active, insider, close-in, distribution, etc.)

4. Different operational threat environments (e.g., first generation [script kiddies], second generation [non- nation state sponsored], & third generation [nation state sponsored])

5. General attack stages (e.g., foot printing & scanning, enumeration, gaining access, escalation of privileges, maintaining access, network exploitation, covering tracks, etc.)

6. How traffic flows across the network [e.g., Transmission Control Protocol (TCP) & Internet Protocol (IP), Open System Interconnection Model (OSI), Information Technology Infrastructure Library, v3 (ITIL)

7. IA principles & organizational requirements (relevant to confidentiality, integrity, availability, authentication, non-repudiation)

8. Interpreted & compiled computer languages

9. Agency specific local specialized system requirements (e.g., critical infrastructure systems that may not be used standard IT) for safety, performance, & reliability*

10. Network access, identity & access management (e.g., public key infrastructure, PKI)

11. Network protocols such as TCP/IP, Dynamic Host Configuration, Domain Name System (DNS), & directory services

12. Network security architecture concepts including topology, protocols, components, & principles (e.g., application of Defense-in-Depth)

13. Agency penetration testing principles, tools, & techniques (e.g., core impact, metasploit, neosploit, etc.)*

14. Programming language structures & logic

15. Agency relevant laws, policies, procedures, or governance as they relate to work that may impact critical infrastructure

16.System & application security threats & vulnerabilities (e.g., buffer overflow, mobile code, cross-site

17. Understand regulatory compliance & audit standards

Skills:

18. Applying host/network access controls (e.g., access control list)

19. Assessing the robustness of security systems & designs

20. Conducting vulnerability scans & recognizing vulnerabilities in security systems

21. Evaluating the trustworthiness of the supplier &/or product;

22. Mimicking threat behaviors

23. Performing damage assessments

24. Performing packet-level analysis (e.g., Wireshark, tcpdump, etc.)

25. Use of penetration testing tools & techniques*

26. Use of social engineering techniques

27. Network analysis tools to identify vulnerabilities. (e.g. Qualys, Nessus, etc.)

28. Using application analysis tools to identify vulnerabilities. (e.g. Checkmarx, Qualys, etc.)

Abilities:

29. Interpret & incorporate data from multiple tool sources

30. Identify & Gather facts & formulate rea-sonable explanation & valid conclusions

31. Work in a team environment

32. Successfully pass the State of Ohio Com-puter [SOCC] background check

*Developed after employment.