| The University of Washington (UW) is proud to be one of the nation's premier educational and research institutions. Our people are the most important asset in our pursuit of achieving excellence in education, research and community service. Our staff not only enjoys outstanding benefits and professional growth opportunities, but also an environment noted for diversity, community involvement, intellectual excitement, artistic pursuits, and natural beauty. |
The Institute for Health Metrics and Evaluation (IHME) is an independent research center at the University of Washington focused on expanding the quantitative evidence base for health. IHME aims to provide policymakers, donors, and researchers with the highest-quality quantitative data to make decisions that achieve better health. IHME's research spans multiple disciplines and policy-relevant areas including resource tracking, cost-effectiveness, forecasting, burden of disease, geospatial analysis, and impact evaluations. It has established international scientific credibility for developing innovative multidisciplinary methods and producing cutting-edge results. IHME aims to be nimble and entrepreneurial in its work, taking on daunting analytic challenges in order to provide critical information that can help answer big-picture questions at the most local levels possible, such as:
What is the state of the world's health?
What impact are different programs, initiatives, and policies having on improving health?
What investments and decisions can we make today that will improve health most in the future?
IHME accomplishes these aims by working with a wide range of collaborators across the world. Currently, we are engaged with over 2,000 collaborators from more than 125 countries and have undertaken on-the-ground data collection in over 20 countries. Through groundbreaking scientific findings, innovative data visualizations, and policy reports and outreach we have disseminated results around the world and engaged myriad audiences.
IHME has an outstanding opportunity for a Security Specialist. The main purpose of this position is to create and tune rules, notifications, and reports on the security landscape of the technologies being used by IHME. The Security Specialist will document security, privacy, and compliance processes and procedures. The individual is responsible for day-to-day operational effectiveness of information and system security controls and monitoring, responding to security events, and data access enforcement. The Security Specialist will work closely with information technology teams and business stakeholders to assess, develop, and implement effective security controls, IT business continuity, and disaster recovery strategy. The individual will also work with the Research and Business Operations teams to ensure that appropriate access is being given, monitored, and revoked when required.
The Security Specialist will develop and implement the threat model and risk mitigation strategy for IHME technology assets. The individual must make decisions about which approaches and technologies to create or use in evaluating IHME's security landscape. The specialist will analyze log files to determine abnormal behavior, lead an investigation into the circumstances around that behavior, and provide the IHME team with guidance on resolution strategies. The specialist will choose the appropriate tools for incident response and decide the protocols for communicating their work to the Senior Management Team and the staff of IHME.
Oversee and administer access control and account administration of critical information resources and key users using established guidelines.
Contribute to the enhancement and delivery of an integrated identity and access management system.
Manage user administrations for key security tools and systems.
Apply federal regulations (such as FERPA and HIPAA), state Laws, University of Washington and UW Medicine policies and technology standards in the development, support, and maintenance of user accounts and clinical contact data workflow for clinical, administrative, and financial systems.
Monitor, Identify, and Investigate
Monitor, track, and document information security issues and threats to ensure prompt resolution.
Ensure that all monitoring and response efforts are clearly and consistently documented and retained for historical analysis and reporting purposes.
Investigate and recommend appropriate corrective actions for information security incidents.
Leverage current and emerging threat information to better prevent, detect, and respond to security events.
Work closely with internal teams and external vendors to perform security assessments and penetration tests of networks and applications, and prioritize remediation efforts.
Identify security risks and develop solutions to eliminate or minimize risks.
Participate in the identification and escalation of changes that will affect information security policy, standards, and procedures. Execute testing of security tools and control techniques such as firewalls, intrusion detection software, data encryption, data backup and recovery.
Assist in the analysis of new and existing security technologies, policies, and processes to better protect IHME's information assets.
Participate in the evaluation of vendor proposals, conduct process analyses, review information security architectures, and recommend modifications to the information security operations that reduce costs or improve service.
Create technology tools to perform security analysis, incidence response, and mitigation.
Develop communications and actively promote related campaigns for information security awareness among all staff.
Internal consulting on security policies and procedures, aligned with compliance requirements.
Assist in the development and implementation of security policies, standards, and procedures.
Assist in the review, development, testing, and implementation of security plans, products, and control techniques (e.g., password administration, intrusion detection software, data encryption, data backup and recovery).
As a UW employee, you will enjoy generous benefits and work/life programs. For detailed information on Benefits for this position, click here.
| Bachelor's degree in Computer Science or related field, plus three years of related experience, or equivalent combination of education and experience. |
Requires a broad knowledge of online systems, access methodologies, and security procedures to work effectively with client and IT management, staff, and vendors.
Well-versed in security architecture, familiar with current and emerging threats, and can develop risk mitigation strategies required to protect the confidentiality, integrity, and availability of information systems and data.
In-depth knowledge of security-related technologies, such as Cisco PIX firewall OS, Nokia Checkpoint firewall OS, TCP/IP, DNS, SATAN, CyberCop, ISS, nmap, IBM Secure Way, and/or Web Single Sign-On (SSO).
Knowledge of security aspects of multiple platforms, operating systems, software, communications and network protocols, or an equivalent combination of education and work experience.
One or more of the following certifications:
GIAC Certified Incident Handler (GCIH)
GIAC Certified Intrusion Analyst (GCIA)
GIAC Certified Forensic Examiner (GCFE)
Offensive Security Certified Professional (OSCP)
Certified Information Systems Security Professional (CISSP)
Equivalent education/experience will substitute for all minimum qualifications except when there are legal requirements, such as a license/certification/registration.
| Experience hardening/securing virtualization technologies, databases, and operating systems (Windows/Linux) utilizing industry best practices. |
Knowledge of networking concepts (routing, switching, VLANs, ACLs), including analyzing network packet captures.
Knowledge of ISO 17799/27002, FFIEC, desktop, server, application, database, network security principles.
Experience with Infrastructure as a Service (IaaS), such as AWS or Azure.
Experience using FAIR model for risk assessment a plus.