This job might no longer be available.

Senior Security Engineer

The Senior Security Engineer will help maximize our security profile and minimize our exposure to attacks by amateur and professional hackers. They will champion the corporate security program for fellow coworkers and enhance their ability to avoid common security pitfalls in their daily activities. Their efforts will help legions of gamers enjoy the best possible play experience, and they will have the opportunity to battle the brightest minds in the hacking business.

As a Senior Security Engineer at NCSoft, the security programs you develop will help protect and secure our customers, corporate systems, games, and web applications from attack. This means you must have a strong understanding of security philosophies and broad knowledge in networking, systems, client-server application development, cryptography, incident response, data protection, scripting, and information privacy.

To protect our business the Senior Security Engineer will:

Essential Duties and Responsibilities include at least the following: (Other duties may be assigned to meet business needs.)

• Developing security tools and scripts
• Designing, implementing, and improving upon our security-centric CI/CD and IAC environments
• Analyzing access patterns for malicious behavior, and providing mitigation guidance/support
• Identifying significant actual and potential cyber security problems, trends, and weaknesses and recommending specific modifications and solutions to reduce information systems security risks.
• Providing architectural design and coordinating the implementation of security solutions to integrate into existing environments.
• Establishing requirements and making recommendations on the appropriate infrastructure protection tools, methods, and technologies.
• Developing strategies for responding to future security challenges. Demonstrating effectiveness of the program for implementation on an organization-wide basis.
• Reviewing proposed new systems, networks, and software for potential security risks, and resolving integration security issues across disciplines.
  • Defining the scope and level of detail for applicable security plans and policies.
• Interpreting and implementing the requirements of CIS, NIST, ISO/IEC, PCI, SOX, and HIPAA policies, mandates, and standards.
• Acting as a key member of the Incident Response Team and may be called upon to represent in the investigation of serious cyber security violations that potentially impact the integrity of NCSOFT infrastructure.
  • Recommending action for containment and remediation based on findings. Follows up to ensure the implementation of corrective actions.
• Investigating and responding rapidly to security incidents.
  • Acquiring, analyzing, and interpreting events, artifacts, and logs to accomplish rapid and accurate incident response.
• Educating game developers in security best practices.
• Maintaining accurate and comprehensive documentation.
• Mentoring junior members of the security team

Qualification/requirements:

• 2 years of experience as a network or systems administrator, and at least 4 years as a security engineer required.
• Extensive knowledge and current hands-on experience in the following areas:
• Project management skills: Ability to develop plans and projects for information security systems that anticipate, identify, eliminate, and prevent information system vulnerabilities; to develop a security incident response policy; and, to lead the implementation of an intrusion detection and prevention program designed to anticipate and eliminate system vulnerabilities.
• Network Security Monitoring and Protection: Mastery of information systems security principles, concepts, and methods. Ability to identify threats and risks, design and implement security controls. Hands-on experience configuring and deploying Network/Application/Host based Firewalls, IDS/IPS, packet analyzers, Web Proxies, Centralized log/SIEM systems, etc.
• Incident Handling: Intimate knowledge of security incident lifecycle, process, coordination, communication, and reporting.
• System and Application Vulnerability Management: Intimate knowledge of SCAP-compliant vulnerability management systems and web application security analysis tools.
• Networking: In-depth knowledge of network protocols, routing, VLAN, switching, and the ability to utilize packet sniffers and analyze packet traces.
• Operating Systems: Extensive hands-on experience with configuring, securing, monitoring, and troubleshooting client and server class operating systems.
• Practical knowledge of computer forensics methods and procedures.
• Strong scripting/coding aptitude.

Education/Training/Experience:

• CISSP, SANS GIAC, or OSCP desired.
• Familiarity with security standards and frameworks such as: CIS, ISO/IEC 27001/27002, PCI, SOX, HIPAA, etc.
• Advanced knowledge of CSPM/CWPP implementations and concepts.
• Advanced knowledge of CI/CD and IAC implementation and concepts.
• Advanced knowledge of malware detection and protection.
• Advanced knowledge of networking and virtualization technologies.
• Experience with emerging cloud security services and technologies.
• Experience with general security assessment best practices.
• Experience with Disaster Recovery Planning.
• Experience with server installations and hardening best practices.
• A proven professional with excellent interpersonal, written, verbal, and time management skills.
• Strong presentation skills and a team player.
• Ability to communicate technical information to non-technical personnel.
• Must be able to work nonstandard hours, nights, weekends and/or holidays.
• A passion for gaming.