Information Security Technical Lead
- USA Only
Title: Information Security Technical Lead (Remote)
At Freddie Mac, you will do important work to build a better housing finance system and you’ll be part of a team helping to make homeownership and rental housing more accessible and affordable across the nation.
Are you someone with a passion for Information Security and have a strong background in finding vulnerabilities? We are seeking a Technical Lead to join our vulnerability hunting team.
Your Work Falls into Three Primary Categories:
- Scanning of infrastructure and network devices, operating systems, databases, and wireless to detect vulnerabilities and misconfigurations
- Create custom scans and scan policies, tune settings for optimal performance and troubleshoot scan issues
- Provide enhanced vulnerability analysis and contextual feedback to stakeholders for discovered vulnerabilities or misconfigurations.
- Investigate false positive findings
- Report metrics for scan coverage and discovered misconfigurations or misconfigurations
- Deploy, maintain, and tune scanners to meet current and future needs
- Troubleshoot issues with the scans, credentials, agents, policies
- Update scan zones to include new network ranges
Baseline Security Configurations
- Develop custom audit scripts for automated monitoring of approved Baseline Security Configurations (BSC) for servers, workstations, network devices, databases, etc.
- Work with platform SMEs to ensure accuracy and completeness for the BSC scans
- Design monitoring solutions for new and existing technologies to determine compliancy with published standards.
- Tune scan policies for accuracy and speed
Develop Team Capabilities and Leadership
- Generate innovative ideas and challenge the status quo
- Develop scripts, automations, tools, or methodologies to enhance the team’s processes and capabilities, and reduce toil
- Create/update runbooks and SOP documentation
- Participate in and actively support mentoring with other members of the team, and mentoring less experienced staff
This position can be performed from a remote location in the U.S.
The vulnerability hunting team is responsible for continuous monitoring for vulnerabilities and mis-configurations across multiple environments, and technologies. These include local and cloud infrastructure, databases, endpoints, perimeter and others.
Provide domain expertise in Vulnerability and Compliance Scanning for on-prem and cloud Infrastructure, as well as enhanced vulnerability analysis and contextual feedback to support the resolution of discovered vulnerabilities and facilitate risk awareness. In this role, the candidate will deploy and administer various scanning solutions or automations to ensuring completeness and maintain scan coverage.
- 8-10 years hands-on experience, working with security tools and performing vulnerability, and compliance scanning
- Bachelor of Science in Engineering, Computer Science, Information Technology, or equivalent work experience
- Must have expert knowledge of Linux and Windows operating systems, and cloud technologies
- Must have advanced knowledge in networking and databases
- Must have solid understanding of deploying and maintaining scanning infrastructure
- Must be proficient with scripting languages – Python, Bash, PowerShell
- Experience leading projects and initiatives
- Preferred certifications: CISSP, AWS/GCP/Azure
Keys to Success in this Role:
- Critical thinking and problem-solving skills
- Good communication skills
- Ability to work independently, as well as on a team of individuals with variety of skills and backgrounds
- Innovative in providing solutions and loves new challenges
- Detail oriented