The data security engineer will work as member of the data security team. The role is appointed to support the Bank’s cyber Security and data protection efforts and to support the organization through a complex, evolving data privacy environment. The job holder is expected to have a thorough understanding of complex banking data processing environments and stay up to date with the latest data security standards and best practices. In addition to anticipating possible data security threats and identifying improvement opportunities, the Data Security Engineer must respond promptly to possible data breaches and coordinate the incident response plan effectively.
Principal Responsibilities, Accountabilities and Deliverables of Role:
- Assist the data security architect and other architects in defining the security architecture and processes to protect the Bank’s data.
- Manage the day-to-day activities, executing, assessing and helping to build a data protection program
- Maintain and monitor rules that protect sensitive data within the corporate networks, keeping data safe and helping the Bank to be compliant
- Maintain and support the continuous enhancement of the Bank’s enterprise Data Loss prevention solutions
- Support proof of concepts and projects to mature the Bank’s data protection defences
- Work closely with various IT departments to carry out information security tasks and projects
- Support the implementation and design of a Group wide data protection solution, including Cloud DLP, Mobility DLP, End point DLP, WEB and email DLP.
- Support data owners and system owners with data/system classification initiatives, including data labelling, encryption and information rights management.
- Support the Security Operations Centre team and security analysts on investigating and following up until resolution data security events and incidents.
- Support the Security Administration activities in analysing and enhancing the processes and tools followed for granting and managing access rights to data and systems.
- Prepare technical documentation to document data architecture and security controls, and playbooks to manage potential data breach incidents.
Job Context (Circumstances & environment surrounding the job):
A key role in cyber and information security is to identify and mitigate data security threats. To that end, Bank ABC is creating a function within the CISO organization to ensure the Bank has a data-centric security framework and processes for protecting structured and unstructured data and other information by enforcing and maintaining a set of security controls, systems and techniques which should allow the Bank to discharge its global data protection and cyber security obligations.
- Strong knowledge of data loss prevention mechanism
- Knowledge in data-protection software and hardware solutions including application, database, and file level encryption and tokenization solutions
- Strong knowledge of Information Security standards and controls (e.g., ISO 27001/27002, NIST CSF, CIS TOP 20)
- Knowledge of common data security architecture (CDSA), including cryptographic, use of certification authorities, digital signatures, API authentication.
- Knowledge of dynamic application security testing (DAST) and static application security testing (SAST)
- Knowledge of Cloud Computing Security, including AWS and Azure management, APIs and WEB services, and DAST and SAST for cloud solutions.
- Understanding of capabilities for storage and database native security and security products, and experience with implementing/evaluating those technologies.
Education / Certifications
- University degree with an IT background
- Recognized and active information security qualifications (e.g., CISSP, CISM, EC Council or SANS related certifications.).
- At least 10 years of work experience
- 5+ years of experience in Information Security with a focus on data protection
- Recent, full-time working experience with financial institutions
- Practical experience on working with data loss prevention solutions
- Practical experience with information rights protection solutions and data encryption
- Strong team player
- Fluent in English (mandatory)
- Ability to organise and prioritise tasks
- Able to conduct the role with minimum supervision
- Strong communication skills capable of dealing with wide range of internal and external stakeholders.