Information Security Engineer

Job Description

The primary responsibility of this position is to assist and support Groupon’s InfoSec and AppSec security engineering teams. The Security Administrator position’s responsibilities will include but are not limited to: Processing security-related alerts, assist in vulnerability remediation and incident handling across global resources, supporting and enhancing InfoSec-managed tools, maintaining security controls & administration of Google Apps, secure file transfer and remote access technologies, and to provide general information security technology support.

Responsibilities:

• Perform changes and administer security controls within Groupon’s global email security platforms
• Manage a portfolio of domains and assist in domain management including registrar migrations, domain recovery, and brand protection for Groupon related trademarks.
• Administer and support endpoint security tools and technologies to help detect and remediate malware detections and identify potential threat activity
• Perform technical security assessments against internal and external facing systems
• Implement new security technologies as required to support a dynamic/challenging business environment.
• Work closely with the senior leadership teams in a collaborative environment to improve the current security framework and education of employees.
• Implement security controls and assist teams with operational support for Groupon’s remote access technology solutions
• Provide technical and non-technical guidance and support for Groupon’s SSL certificate process
• Approve requests and facilitate access to security systems including maintaining multi-factor authentication systems
• Monitor and support security software/systems that will help ensure compliance with regulatory, industry, and corporate policies and procedures. This includes but is not limited to: endpoint security (anti-malware, encryption), IDS/IPS (Host/Network/Wireless), secure file transfer, log management/correlation, secure password storage/retrieval, Application Whitelisting, vulnerability management, etc.
• Work with Security, Engineering and other business teams to investigate and resolve Incident Response situations
• Provide information security guidance within cloud computing technologies
• Work with Sr. Security Engineers to ensure security best practices are identified and integrated into all facets of projects including network, system designs/configuration, and implementations.
• Identify and recommend potential areas where existing data security policies and procedures require change, or where a supplement is required to mitigate key security risks.
• Individual must have a level understanding of business needs, Engineering/IT capabilities, and security requirements to insure a proper balance is maintained.
• Coordinate, develop, and maintain system documentation. Monitor and review changes and documentation updates for accuracy, currency, and compliance with policies and procedures.

Qualifications:

• 5+ years of Information Security experience, in a highly technical hands on environment.
• 2+ years experience securing Google Apps and other email security tools
• Ability to implement and troubleshoot modern industry best practices around email domain security
• 2+ years working with endpoint security solutions involving malware detection, correlation rule detections, performing threat analysis, etc.
• Must demonstrate the ability to investigate and weed out false positives and improve overall security intelligence.
• Experience using various industry-standard digital forensics utilities for collection of Windows, OSX, Linux, Android, and iOS devices
• Proven experience within Incident Response situations and can demonstrate the ability to handle and maintain confidential information in a professional manner.
• Experience securing remote access solutions (VPN, NAC, SSO, SAML, device control, etc)
• Ability to implement and troubleshoot multi-factor authentication technologies (Duo, Yubikey, TOTP-based mobile apps, etc)
• Familiar with role based access controls (RBAC) and concept of least privileged access.
• Experience using and securing cloud computing services such as AWS, Google Cloud, Microsoft Azure
• Experience applying basic operating system security concepts across Linux, OSX, and Windows systems
• Must possess a basic understanding of core modern computing functions (e.g. TCP, UDP, IPSec, DNS, public/private key cryptography concepts, routing and switching knowledge, SSL certificates & encryption, HTTP & HTTPS, SFTP, TLS)
• Must have experience with common open source command line & GUI-based tools for network and general troubleshooting ( Wireshark, nmap, tcpdump)
• Familiar with security controls or concepts related to various security community groups or standards such as OWASP, NIST, CIS benchmarks, OSI model)
• Familiar with log management and SIEM solutions (e.g. Chronicle, Splunk, Syslog-ng).
• Knowledge of scripting languages such as Perl, Python, Bash is a plus
• Diligent in coordinating and executing processes and procedures.
• Exhibits self-motivation and takes initiative.
• Must be comfortable working within a geographically decentralized environment
• Must possess sound interpersonal skills with a strong ability to communicate effectively both across as well as within technical and business departments.
• Strong leadership skills and ability to mentor or provide guidance to teams.
• Bachelors Degree or equivalent work experience.
• High level of customer service focus.
• Know & maintain the passcode to the air shield.