Operational Security Engineer (M/F)
Operational Security Engineer on BGL bank's Vulnerability Management & Follow-up squad: runs the vulnerability scan lifecycle (preparation, execution, analysis), tracks remediation with stakeholders, produces security KPIs, and maintains scanning tools across on-prem, DMZ and cloud. Core tech: Qualys, Tanium, ELK Stack, Power BI, Python, PowerShell.
- Compensation
- Not disclosed
- Location
- Not listed
- Work setup
- Not specified
- Seniority
- Not specified
- Employment
- Not specified
- Experience
- Not specified
- Category
- Security
- Posted
Skills
Must have
- Qualys and Tanium (Vulnerability/Compliance modules, Self-Assessment, APIs, Comply)
- ELK Stack
- Power BI and Power Query
- NIST / CIS Benchmarks
- OWASP
- PTES (Penetration Testing Execution Standard)
- ISSAF (Information Systems Security Assessment Framework)
- OSSTMM (Open Source Security Testing Methodology Manual)
- ISO 27001
- Linux and Windows environments
- Cloud environments
- Python scripting
- PowerShell scripting
- Regular Expressions (Regex)
- Detailed understanding and analysis of standard network protocols
- Fluent French
- Good written and spoken English
- Ability to collaborate and work as part of a team
- Organizational skills
- Rigor and attention to detail
- Proactivity
- Strong oral and written communication skills
- Adaptability
- Curiosity and willingness to learn
- Ability to understand, explain, and drive change
- Project management skills
- Ability to develop and adapt processes
- Ability to work using Agile methodologies
Full description
CONTEXT AND CHALLENGES
The mission of BGL ProdSec is to ensure a secure, resilient, and compliant production environment, in line with security requirements and best practices, by protecting BGL's critical systems, data, and operations against internal and external cyber threats.
To achieve this, it provides the following security services:
- Identity Management: responsible for managing employee and partner identities and access rights to the bank's systems and data;
- Supervision & Control: responsible for the monitoring, deployment, and maintenance of Active Directory environments and the Anti-Malware Protection framework (EDR and Antivirus). It also ensures the alignment of log collection environments with the Group, in close cooperation with relevant teams, as part of the deployment of new intrusion detection use cases (signals);
- Vulnerability Management & Follow-up: responsible for detecting vulnerabilities and technical non-compliances, as well as organizing and monitoring their remediation;
- Network Filtering: responsible for implementing traffic filtering policies through security devices such as WAF, Firewall, Proxy, and DDoS protection solutions for BGL's critical systems;
- Data Protection & Encryption: responsible for maintaining an inventory of encryption keys and certificates, ensuring the protection of BGL data, and detecting security events across the network.
As an Operational Security Engineer, you will be a member of the Vulnerability Management & Follow-up Squad.
##
WHAT WILL YOUR ROLE AND DAILY RESPONSIBILITIES BE?
The Operational Security Engineer is a recognized IT expert in their field. They are responsible for a community of practice around a specific discipline and ensure the relevance and performance of their area of expertise in support of the Production Security Center of Expertise (CoE).
The Operational Security Engineer plays a central role and is responsible for monitoring the vulnerability and non-compliance management process, from scan preparation through execution and analysis, to the presentation of findings and the production of security performance indicators.
##
THE MISSIONS MATTER, BUT SO DO THE TEAM AND THE WORKING ENVIRONMENT!
Your Working Environment
As a member of the Vulnerability Management & Follow-up Squad, your objectives will include:
- Monitoring compliance with security standards through the preparation, execution, and analysis of vulnerability scans;
- Presenting detected vulnerabilities (new findings and those approaching their remediation deadlines) and monitoring remediation activities with stakeholders across the various Tribes;