Security and Risk Specialist (TS/SCI)

Cisco Systems, Inc.
United States, Charlotte
June 08, 2023
* The successful applicant will be performing work on US Government classified environments, and therefore, must be a U.S. Person (i.e., U.S. citizen, U.S. national, lawful permanent resident, asylee, or refugee). This position may also perform work that the U.S. government has specified can only be performed by a U.S. citizen on U.S. soil. The successful applicant must have a current US Government TS/SCI Clearance - Current/active or previously held within the last 6 months * WHAT YOU'LL DO You will be working in an agile, fast-paced, and collaborative environment. You will work to establish relationships, build effective teaming/pairing, harness and use the strengths of a team, influence where possible, and drive towards vital deliverables. You will establish partnerships in the Security & Trust Organization, Cisco Legal, People and Communities, Product Engineering, Incident Response (CSIRT), DES (IT), Supply Chain, Talos, Strategic Communications, and Corporate Security to identify and focus threat research and inside risk. You will also: Help to draft and document internal solutions that are responsive to emerging inside risk. Conduct and document hands-on technical research, in coordination with internal and external partners, on lead data related to potential (digital) threats to Cisco. Author and coordinated on papers and presentations to deliver internally across Cisco and to partners/customers, with a near-term focus on risks posed by emerging threats and industry trends. Understand the current threat landscape and help to translate insights into technical and operational security requirements. Support efforts to influence industry trends. Share your thought leadership with policy and government leaders to help them develop the best regulations and frameworks to enhance security. WHO YOU'LL WORK WITH Cisco's Trust Office is a part of the Security and Trust Organization (STO) and plays a central role in making Cisco trustworthy, transparent, and accountable in security, privacy, and data protection. We work with our Cisco teammates, plus global customers, regulators, and industry leaders to influence critical emerging security standards. We also develop and incubate internal strategies to embed the cyber security and data protection needs of our customers and enable sales by reducing customer friction. We play a significant role in helping our customers to have deeply rooted trust in Cisco. WHO YOU ARE: An innovative, technical, and highly motivated team-player who is passionate about growing our corporate insider risk program. You will identify and implement new insider threat tools, in addition to applying existing security capabilities to mitigate risk. Using your experience and skills, you will design, implement, and document technical and administrative controls to detect, deter, and respond to insider threats; create, evaluate, and hone insider threat alerting criteria; and automate and streamline security processes. QUALIFICATIONS Bachelor's Degree in Computer Science, Information Systems, or a related field preferred. 3-5+ years of experience identifying and prioritizing sensitive information, assets, and activities, evaluating the threat(s), identifying vulnerabilities, and implementing appropriate countermeasures to streamline and automate existing processes and champion new technologies to enhance Cisco's insider threat posture. Must have experience conducting investigations related to insider threats and other related and administrative topics as directed 2+ years' experience as a Credentialed Counterintelligence (CI) Officer trained by a certified US Federal Government organization, or equivalent, preferred 2+ years' experience of OPSEC, INFOSEC, Law enforcement, and CI Must have technical skills related to data triage (large volumes of data) and forensic analysis of endpoint devices. Expert-level in Splunk (as this will be used ~80% daily, and specific experience and use of Digital Guardian, Exabeam, Code42 is required. Be able to and know how to maintain mechanisms for the exchange of threat and vulnerability information and best practices Experience interpreting data from network and host-based monitoring solutions and ingesting and analyzing non-technical data feeds to uncover anomalies and attributes of potential insider risk activity Elevate events of concern and produce insider threat leads that document issues on computer misuse, various violations of policies, counterintelligence concerns, foreign influence, financial stressors, threats to self or others, and other insider threat concerns Effectively collaborate with internal organizations and external partners on cases of concern, and to implement technical controls, identify use cases, integrate, and ingest appropriate data sources, develop analytics, and refine alert criteria. Provide analytic support to investigations, and administrative or security inquiries. Be able to maintain SOPs, and brief team members on emerging threats and indicators. Collaborate with outside Insider Threat Professionals and Functional teams to develop innovative insider threat capabilities to further enhance our proactive and reactive process; ensure compliance with SOPs, policies, and directives. Where guidance does not exist but should, then be able to create and assist in leading policy through approval process. Knowledge of Cyber Security Operations Center or similar environment methodology, to include threat monitoring, intrusion detection, incident response, handling, and remediation Superior writing and briefing skills to present and publish finished analytical reports, synopses and other briefings as required Understanding of statecraft, national security and international affairs, and foreign policy preferred` CAP, CISSP, CISA, CISM or related SANS certifications preferred WHY CISCO? #WeAreCisco. We are all unique, but collectively we bring our talents to work as a team, to develop innovative technology and power a more inclusive, digital future for everyone. How do we do it? Well, for starters - with people like you! Nearly every internet connection around the world touches Cisco. We're the Internet's optimists. Our technology makes sure the data travelling at light speed across connections does so securely, yet it's not what we make but what we make happen which marks us out. We're helping those who work in the health service to connect with patients and each other; schools, colleges and universities to teach in even the most challenging of times. We're helping businesses of all shapes and size to connect with their employees and customers in new ways, providing people with access to the digital skills they need and connecting the most remote parts of the world - whether through 5G, or otherwise. We tackle whatever challenges come our way. We have each other's backs, we recognise our accomplishments, and we grow together. We celebrate and support one another - from big and small things in life to big career moments. And giving back is in our DNA (we get 10 days off each year to do just that). We know that powering an inclusive future starts with us. Because without diversity and a dedication to equality, there is no moving forward. Our 30 Inclusive Communities, that bring people together around commonalities or passions, are leading the way. Together we're committed to learning, listening, caring for our communities, whilst supporting the most vulnerable with a collective effort to make this world a better place either with technology, or through our actions. So, you have colorful hair? Don't care. Tattoos? Show off your ink. Like polka dots? That's cool. Pop culture geek? Many of us are. Passion for technology and world changing? Be you, with us! #WeAreCisco #LI-RK #LI-Remote