Cyber Security Tooling Specialist (Palo Alto, NetWitness,...

Plenty of security posts are about advice. This one is about hands on hardware and software: standing up boundary protection, detection, monitoring and forensic tooling, integrating it into existing environments, testing it properly and handing it over to operations in a state someone else can run.

The tooling is named rather than hypothetical, and the work runs from configuration baselines through validation and acceptance to the hardening guides and standard operating procedures at the end.

What you would be doing

• Install, configure and test firewalls, routers, switches, proxies and VPN concentrators for security and efficiency.
• Install, configure and test vulnerability assessment tooling, including Tenable Nessus.
• Install, configure and test forensic tooling, including AccessData.
• Install, configure and test monitoring, detection and incident response tooling, including RSA NetWitness and Splunk.
• Install, configure and test virtualisation and software-defined networking technologies.
• Implement and validate security settings across Cisco, Juniper, Linux, Unix and Microsoft environments.
• Assess network performance, security and availability through continuous monitoring and analysis.
• Investigate faults, incidents and performance problems, and implement the improvements.
• Run testing, validation and acceptance for deployed capabilities.
• Write the technical documentation — installation guides, configuration baselines, test plans and reports, procedures, hardening guides.
• Advise on architecture, tool configuration, system integration and operational improvement.
• Support vulnerability management and incident response, including evidence collection, log analysis and reporting.
• Support handover to operations, including knowledge transfer and training.

What you would bring

• At least five years in cyber security or a comparably demanding technical field.
• Broad knowledge of security tooling and its configuration, including boundary protection — firewalls, intrusion prevention on network and host, data diodes.
• Encryption, identity and access management, monitoring and detection, incident response, vulnerability assessment, forensics and risk management.
• Recent hands-on work with Juniper, Palo Alto, web application proxies, RSA NetWitness, Splunk, Tenable Nessus and AccessData.
• Design and configuration of infrastructure within projects — routing, switching and virtualisation such as VMware.
• A record of delivering systems and capabilities to government or defence customers, including work deployed in the field.
• Excellent technical writing and communication in English at professional level.
• Working proficiency with the ArchiMate modelling language.

A degree in a related discipline with three years of post-related experience, or about ten years of progressive experience instead. Implementation projects within NATO or a national military organisation are desirable.