INFORMATION SECURITY ENGINEER ATTACK SURFACE MANAGEMENT (JR226349)

<strong>To heal, to teach, to discover and to advance the health of the communities we serve.<br /></strong><br /> <p>To learn more about the &ldquo;Montefiore Difference&rdquo; &ndash; who we are at Montefiore and all that we have to offer our associates, please click <a href="http://www.mymontebenefits.com/montefiore-difference" target="_blank" title="Montefiore Difference" rel="noopener noreferrer">here</a>.&nbsp;</p>

Yonkers, New York

Montefiore

<h4 class=""><strong>WHY TOP TALENT PICKS MONTEFIORE EINSTEIN&nbsp;<br /><br /></strong>Since its inception in 1884, Montefiore Einstein&rsquo;s mission has been to heal, to teach, to discover and advance the health of the communities we serve.<br /><br />Montefiore Einstein&rsquo;s state-of-the-art facilities include the&nbsp;<span class="">internationally-recognized</span>&nbsp;Children&rsquo;s Hospital at Montefiore Einstein and our Notable Centers of Excellence - Montefiore Einstein Center for Cancer Care, Montefiore Einstein Center for Heart and Vascular Care, Montefiore Einstein Center for Transplantation. Combined with a growing number of locations throughout the Bronx and Westchester County, Montefiore Einstein is the ideal organization to apply and hone your expertise.<br /><br /><span style="text-decoration: underline;"><a href="https://montefiore.wd12.myworkdayjobs.com/en-US/MMC/login" target="_blank" title="Candidate Home" rel="noopener noreferrer">Sign In</a></span>&nbsp;- Candidate Home<br /><span style="text-decoration: underline;"><a href="https://montefiore.wd12.myworkdayjobs.com/en-US/MMC/introduceYourself" target="_blank" title="Introduce Yourself " rel="noopener noreferrer">Introduce Yourself&nbsp;</a></span>-&nbsp;Please let us know about yourself so we can keep in touch about future job openings!<br /><br /><strong><span class="">NURSE&nbsp;RECRUITMENT&nbsp;HOTLINE:</span>&nbsp;<span class="">718-920-6697 (</span><span class="">Monday-Friday: 9am-4pm)&nbsp;&nbsp;</span></strong><br /><br /><strong>Check Out Our Employee&nbsp;<span style="text-decoration: underline;"><a href="https://www.mymontebenefits.com/thinking-of-joining-montefiore" target="_blank" title="Benefits" rel="noopener noreferrer">Benefits<br /><br /></a></span></strong></h4> <h4 class="p1"><span style="text-decoration: underline;"><strong><a href="https://s3.us-east-1.amazonaws.com/vizi.vizirecruiter.com/MontefioreHealthSystem+RecruitingPractices.pdf" target="_blank" title="Safe Online Recruiting" rel="noopener noreferrer">Our Commitment to Safe Online Recruiting</a></strong></span></h4> https://www.montefiore.org/

keywords: position summary,position details,pay rate,management,performance,teamwork,document,develop,healthcare,cloud,security,quality assurance,education,experience,certifications,knowledge,skills

Day / 8:30 AM-5 PM

$116,000.00-$145,000.00

Overview: An Attack Surface Management (ASM) Engineer performs the security efforts aimed at identifying, managing, and mitigating risks associated with Montefiore Einstein&rsquo;s entire attack surface. This role is crucial in safeguarding patient data, medical devices, and healthcare systems against cyber threats. The Engineer is responsible for executing processes related to device discovery, vulnerability management, and penetration testing services. They will also contribute to the tracking and communication of security metrics, helping the organization make informed decisions regarding it&rsquo;s security posture.
Responsibilities: <ul> <li>Perform continuous device and asset discovery across the system, including IoT devices, medical equipment, and IT infrastructure.</li> <li>Collaborate with clinical engineering and IT teams to ensure comprehensive visibility into all connected devices.</li> <li>Leverage new and existing tools and processes to maintain an accurate inventory of devices and ensure real-time updates.</li> <li>Contribute to an enterprise-wide vulnerability management program to identify and remediate vulnerabilities in medical devices, networks, applications, and systems.</li> <li>Communicate with Product Owners and technology teams across the system to prioritize patching efforts based on risk to ensure critical assets are protected.</li> <li>Coordinate regular third-party penetration testing and assessment efforts, to identify vulnerabilities and weaknesses in medical devices, networks, applications, and systems.</li> </ul> <ul> <li>Manage penetration test schedules and remediation plans, to ensure vulnerabilities are effectively mitigated.</li> <li>Create reports for executive leadership detailing the outcomes of penetration tests and remediation strategies.</li> <li>Remain aware of vulnerability trends and emerging threats in the healthcare sector to proactively adjust defensive measures.</li> </ul> <ul> <li>Coordinate with SOC (Security Operations Center) teams in response to incidents based on identified vulnerabilities.</li> </ul> <ul> <li>Develop and refine standard operating procedures (SOPs) for device discovery, vulnerability management, and third-party penetration testing.</li> <li>Document clear and efficient workflows for responding to vulnerabilities.</li> <li>Work with architecture and engineering personnel to implement automation and orchestration solutions where appropriate to improve efficiency and reduce manual effort.</li> </ul> <ul> <li>Define and track key performance indicators (KPIs) and metrics for attack surface management, such as time to patch, vulnerability aging, and device risk scoring.</li> <li>Prepare summarized reports and dashboards for leadership, outlining the organization&rsquo;s attack surface management risk posture and provide recommendations to prioritize remediation initiatives.</li> </ul> <ul> <li>Collaborate with IT, clinical teams, and other departments to ensure cybersecurity measures are integrated into everyday operations without disrupting patient care.</li> <li>Manage vendor relationships related to security solutions, testing services, and consulting engagements.</li> <li>Maintain security tools and services ensuring continued uptime and efficient execution of scanning activities.</li> <li>Work with DevOps, cloud, and IT infrastructure teams to incorporate secure development practices and vulnerability remediation into their workflows.</li> </ul>
Requirements: <p><strong>Common Technologies &amp; Products:</strong></p> <p>The Attack Surface Management Engineer is expected to have familiarity with leading commercial and open-source tools commonly used across the security industry.&nbsp;</p> <p>&nbsp;</p> <p><strong>Education &amp; Experience:</strong></p> <p>Required:</p> <ul> <li>Bachelor&rsquo;s degree or equivalent experience in Information Security, Computer Science, or related field, or equivalent work experience required.</li> <li>Minimum of 7 years of experience in cybersecurity, with a focus on vulnerability management, penetration testing, or threat hunting/intelligence.</li> </ul> <p>Preferred:</p> <ul> <li>Master&rsquo;s degree in Cybersecurity, Information Technology, or Business Administration.</li> <li>Prior experience working in the healthcare industry or other highly regulated environments.</li> </ul> <p>&nbsp;</p> <p>Certifications</p> <p>Preferred:</p> <ul> <li>CISSP (Certified Information Systems Security Professional)</li> <li>CEH (Certified Ethical Hacker) or OSCP (Offensive Security Certified Professional)</li> <li>GIAC Penetration Tester (GPEN)</li> <li>GIAC Certified Incident Handler (GCIH)</li> <li>Certified Healthcare Information Security and Privacy Practitioner (HCISPP)</li> </ul> <p>&nbsp;</p> <p><strong>Requirements Include:</strong></p> <ul> <li>Strong understanding of healthcare cybersecurity regulations and compliance (e.g., HIPAA, HITECH, NYSDOH 405.46).</li> <li>Strong understanding of information security control frameworks (e.g., NIST 800-53, HICP, HITRUST).</li> <li>Experience working with risk detection and prioritization solutions in a cloud enterprise.</li> <li>Experience working with network and platform vulnerability best practices, and tools such as Wiz and Tenable or similar.</li> <li>Strongly prefer exposure to IoMT (Internet of Medical Things).</li> <li>Ability to balance security controls with the needs of business, clinical and IT operations.</li> <li>Excellent verbal and written communication skills, including the ability to present complex technical information to non-technical stakeholders.</li> <li>Strong analytical and problem-solving skills, with the ability to prioritize and manage multiple initiatives simultaneously.</li> </ul>