Senior Information Security Engineer

Who We Are:
At Brooks, we believe movement is the key to feeling more alive. That’s why we’re driven to create gear and experiences that take people to the place that makes them feel more alive — whether it’s a headspace, a feeling, or a finish line.  Everyone who works at Brooks is propelled by a company culture that sparks excitement, fuels collaboration, inspires creativity, and ignites innovation. Our brand values help bond us together and drive our success:  ·      Runner First We act in the best interest of the runner·       Word is Bond  We do what we say we’ll do ·       Champion Heart We give our all in everything we do·      There is no “I” in RunWe stay generous with our humanity ·       Keep MovingWe find ways to move every day, because joy is kinetic!  We welcome everyone from every walk of life looking to inspire others through the power of movement — because we’re all moving towards something. Let’s run there.   
NOTE: You must be located in WA, OR, CA, MT, CO, ID, NV.

Your Job:
The Information Security team is seeking a talented security professional to drive business critical information security initiatives focusing on securing our users and systems. You will serve as a security consultant to key internal IT departments, ensuring their projects incorporate appropriate security controls. You will build a deep understanding of our technical infrastructure, software products, and processes. You will be expected to design, plan and implement strategic and tactical security improvements that will support and protect our business. In addition, as a Brooks Senior Information Security Engineer, you will be expected to provide analysis, definition, and recommendations of information security requirements for all enterprise technologies, computing assets and network infrastructure.  The scope of this role is greater than any one person. Candidate must be skilled in leveraging both internal and external resources through persuasion, management, and negotiation to accomplish security goals in areas where candidate may only possess Tier 2 skills. This is a tremendous ownership opportunity to help Brooks secure the future success of its business. Responsibilities:

• Security Control Design and Implementation
• Ensure the rigorous application of cybersecurity policies, principles, and practices in the delivery of all IT and cybersecurity services
• Design and implement cost-effective controls to reduce business risk from real-world attacks such as ransomware, DDoS, data theft, and account takeovers
• Design and optimize our network boundary protections and sensitive data flows using tools such as firewalls, VPNs, IPS/IDS, CASB, wireless security, network access controls, and web and email security
• Implement and support Single Sign-on, PAM, Multi-factor Authentication, Enterprise Mobility Management, security certificates and SIEM solutions
• Identifies, plans, and documents improvements to security controls already in place
• Adjust security controls to accommodate new technology implementations
• Lead troubleshooting of existing security controls as necessary
• Security Advocate within the Business
• Play an advisory role in IT projects to assess security requirements and controls and to ensure that security controls are implemented
• Lead or manage efforts on design/architecture and system security reviews.
• Assess applications and the associated data flows for risk to sensitive data, systems, or infrastructure.
• Provide management and business clients with information related to security and threat trends to protect the company from internal and external intrusions and risks
• Act as an agent of security awareness, foster and influence good internal information security practices through presentations, training, and other communication opportunities
• Incident Handling and Response
• Act as an escalation point in the investigations of cyber alerts, events, and incidents to ensure thorough investigation and response
• Maintain Situational Awareness
• Maintain a current awareness of information security issues and trends and provide educational briefings to peer groups within the Information Technology department
• Maintain professional security certifications and accreditations
• Other responsibilities as required

Qualifications:

• Bachelor’s degree in IT, Computer Science or related discipline preferred
• 7 years’ experience maturing and improving information security programs
• Comfortable leveraging outside experts for implementation assistance and support
• System engineer level understanding of infrastructure technologies such as Active Directory, virtualization, and Windows operating systems
• Functional knowledge of modern networking protocols such as TCP/IP, IPSEC, VPN, MPLS, and SD-WAN
• Understanding of cyber kill chain as it relates to attacks by cyber-criminals against corporations
• Experience implementing security controls including IDS/IPS, firewalls, EDR, MFA, SSO, PAM, and email filtering
• Experience using SIEM tools for log collection, incident detection, and investigation
• Excellent written and verbal communication skills
• Persuasive negotiator able to exert influence without authority
• Experience identifying cost-effective solutions for complex problems within corporate enterprise
• Excellent analytical, troubleshooting, and problem-solving skills
• Demonstrated ability to identify security events based on network, computer, and user behavior and investigate to eliminate false positives
• Demonstrated ability to identify security vulnerabilities in proposed solutions and suggest alternatives that accomplish business goals while reducing risk
• Experience hardening and applying modern security standards across servers, workstations, SaaS-based solutions, and network equipment
• Demonstrated track record staying up to date with Information Security and threat intelligence knowledge across the security and tech communities.
• Knowledge of security frameworks and methodologies such as CIS Top 18, NIST Cybersecurity Framework, and PCI DSS
• Remain flexible in your point-of-view to support the direction taken by the business
• Possess solid understanding of cryptography basics (public/private keys, TLS certificates, PKI, etc.)
• Professional certifications such as GCIH, CISSP, CySA+ a plus