Information Security Engineers

IT Operations & Cybersecurity

Level 4428 of 1200 points

Job description

Information Security Engineers

Job purpose

To develop information security standards, policies and controls, build and maintain the technology protecting the organisation's networks and data, and monitor, investigate and respond to breaches and intrusions, so that digital files and electronic infrastructure remain protected and weaknesses are closed before exploitation.

Skills

Knowledge of computers and electronics across hardware, software and applications development, supported by engineering and technology and by telecommunications. Specialist command of penetration testing and vulnerability assessment method, perimeter protection and encryption technology, security control design, forensic examination of breaches, and the cybersecurity standards against which computing environments are reviewed. A bachelor's degree is the norm, with a substantial minority qualified by post-secondary certificate or shorter college study, and several years of related experience and on-the-job training.
Trains staff in information security standards and best practice and oversees their use; recommends enhancements to management and explains technical exposure in terms non-specialists can act on; supports users installing and operating security products; and deals with parties outside the organisation. Coordinates others engaged in monitoring and assessment.
Identifies weaknesses through penetration testing, scans networks with vulnerability assessment tooling, judges existing controls against performance indicators, and investigates breaches to establish how access was obtained and what damage was done. The problems are adversarial and often novel: an intrusion method may have no settled precedent, and a wrong call either leaves the exposure open or obstructs legitimate operation.
Develops response and recovery strategies for breaches and oversees plans to safeguard computer files against accidental or unauthorised modification, destruction or disclosure. Determines own tasks and priorities under time pressure.
Work is carried out at a workstation using monitoring, testing and development environments. No manual handling or dexterity demands.

Responsibilities

No formal line management, but guides and directs the work of others and carries some accountability for their output. Coordinates the monitoring of networks and systems for breaches, oversees vulnerability and risk assessments and system testing, and oversees documentation of security and emergency measure policies. The standards and training set here govern how the rest of the organisation handles its systems.
No budget is held. Recommends security enhancements and the tooling to give effect to them, with some oversight of the resources committed to monitoring; authority to commit expenditure rests above the role.
Builds, maintains and upgrades the organisation's security technology — firewall and encryption software, detection and prevention tooling, vulnerability scanning instruments — and develops further tools to detect and analyse threats. Accountable for the configuration and continued functioning of that estate.
Accountable for the confidentiality and integrity of digital files and electronic infrastructure. Writes reports on breach investigations and network evaluations, coordinates documentation of security policies and procedures, and reviews computing environments for compliance with cybersecurity standards. The material held is sensitive in its content and in what it discloses about the organisation's own weaknesses.

Effort required

Exacting attention over long stretches of detailed technical work: test output, scan results and control indicators must be read precisely, because the failure that matters is the anomaly not noticed. Judgement is exercised frequently, under time pressure and on incomplete information while an incident is live, with effects reaching co-workers and company results.
Personal accountability is pronounced: breaches must be investigated and reported to management, including where the cause is a control the postholder designed. Requires composure while an incident is running. No exposure to distress or aggression.
Predominantly seated work at a workstation. No lifting or exertion.

Working conditions

Indoor, environmentally controlled office work throughout, without hazard, noise or weather exposure, and no contact with aggressive or distressed people. Psychological demand arises from a high volume of contact by electronic mail, telephone and face-to-face discussion, and from the consequence of an error in a security control.
Most posts follow a regular established schedule, a minority varying with production or contract demands, and the working week more often than not runs beyond forty hours; no shift or on-call obligation is evidenced. Autonomy is considerable: tasks, priorities and goals are largely set by the postholder, and decisions are frequent and reach beyond the immediate team. Work is done under time pressure, in a competitive field, inside recognised security standards.

Skills

40% · 231 points▾

KnowledgeLevel 4 of 8
72 of 144 points
Factual and theoretical knowledge in broad contexts within a field of work. The job requires a range of thinking and practical knowledge to find solutions to specific problems in the job or study area.
Interpersonal and communication skillsLevel 3 of 5
58 of 96 points
Effective communication and interpersonal relationships. The job holder is required to adapt communication to different audiences and foster trust, cooperation and positive working relationships.
Problem-solving skillsLevel 3 of 5
58 of 96 points
Variable problems. The job involves dealing with different kinds of problems that require careful thinking, research into different options or adjusting existing ways of doing things. Guidance and resources may be limited.
Planning and organisational skillsLevel 3 of 5
43 of 72 points
Moderate organisational skills required. The job requires the organising and prioritising of multiple tasks, with some level of adjustment to plans on the basis of changing circumstances or deadlines.
Physical skillsLevel 0 of 5
0 of 72 points
Not applicable. The job does not require any particular physical skills (although there is likely to be some physical activity).

Responsibility

35% · 123 points▾

PeopleLevel 1 of 5
29 of 144 points
Very limited. Not required to supervise or perform a caregiving role. The job may involve providing basic guidance to or orientation for others, such as helping new colleagues settle in.
Goods and equipmentLevel 1 of 5
17 of 84 points
Limited responsibility for goods or equipment. The job involves the care and proper use of low-value tools or materials, with minimal responsibility for their maintenance or security.
InformationLevel 4 of 5
77 of 96 points
Considerable responsibility for information. The job manages large amounts of valuable or sensitive information, deciding what is needed and how it is used and ensuring it is protected.
Financial resourcesLevel 0 of 5
0 of 96 points
Not applicable. The job does not require any responsibility for financial resources.

Effort

15% · 50 points▾

Mental effortLevel 3 of 5
36 of 60 points
High level of mental effort. The job involves frequent concentration on complex tasks that require considerable mental effort, such as interpreting complex data.
Psychosocial and emotional effortLevel 1 of 5
14 of 72 points
Minimal psychosocial and emotional effort. There is little to no need to manage emotional responses. The job involves minimal exposure to emotionally demanding situations.
Physical effortLevel 0 of 5
0 of 48 points
Not applicable. The job does not require any physical effort.

Working Conditions

10% · 24 points▾

Environment (physical, psychological or emotional)Level 1 of 5
17 of 84 points
Minimal exposure to hazards or stress. The job involves little or no exposure to physical hazards (e.g. chemicals, moving equipment, noise) and minimal emotional or psychological risks (e.g. occasional routine tasks with no emotional burden). There is minor exposure to dust, dirt, fumes, noise, waste, poor lighting, etc.
Organisational environmentLevel 1 of 5
7 of 36 points
Minimal organisational demands. The job requires standard working hours with no night shifts or irregular schedules. There is little or no need for travel or digital connectivity beyond typical working hours.