Mandatory Qualification

• Minimum of five (5) years of experience applying security policies, standards, testing, modification and implementation. At least three (3) years of that experience must be in information security analysis.
• Possession of a bachelor’s degree in an IT-related or Engineering field. Additional qualifying experience may be substituted for the required education on a year-for-year basis.

Desirable Qualifications

Four (4) years of Information Security Specialist experience performing the following tasks:

• • Leading a data classification and categorization effort and document the results in accordance with Data Classification and Categorization Standards.
  • Working with customers to identify and document business impacts and system security classification and data categorization ratings.
  • Performing and collaborating on analysis with other technical staff to identify and document security issues for application components and supporting infrastructure, such as:
    • Non-standard or low-security authentication methods for users, systems, and infrastructure
    • Reused or common credentials
    • User credentials in code
    • Unencrypted end-user passwords and Personal Identifiable Information (PII)
    • Missing security controls bases on the data classification and categorization.
  • Collaborating with Software Developers to identify and document approaches to remediate security issues, including plans to validate security fixes and improvements.
  • Informing/validating remediation approaches with stakeholders.