Cybersecurity Engineer Journey

To provide specialized enterprise-wide security engineering and manage cyber protection, defense, design, development, implementation, and operation risk to our Information, Information and Operational Technology (IT/OT) Systems, and Network Infrastructures.

There are four (4) levels in this job classification series that have similar job content but with progressively more challenging degrees and levels of skill, responsibility, knowledge, experience and qualification requirements:

Flex Classifications (that permit progression from lower-level classes to higher level classes without examination based upon assessment of an individual's experience and performance) within the series:

• Entry: Incumbent acquires knowledge, skills and abilities to perform the tasks associated within the series but are not yet demonstrating these at the Journey level.
• Journey: Incumbent is demonstrating the required skills and knowledge to independently perform the full scope of the job.
  

Non-Flex Classifications (that promote from lower-level classes to higher level classes and require an examination, such as an interview, based upon individual experience and performance) within the series:

• Senior: Advanced journey level resource who is responsible for advanced assignments, as dictated by the work needing to be performed. May serve in a lead/supervisory capacity.
• Principal: Subject matter expert/lead level/supervisory and is responsible for leading the most advanced work, as dictated by the work needing to be performed.
  

Entry to Journey: Incumbents at the entry level are required to successfully "progress" to the journey level within 60 months of appointment to remain within the job series.

Seniors and Principals must be hired through a promotional process and do not automatically progress from lower levels in the series.

• SMUD's Cybersecurity Engineer Journey is responsible for independently performing engineering tasks in support of Senior and Principal cybersecurity engineers to assist with the following work roles:
• Defensive Cybersecurity: Evaluate data collected from various cybersecurity defense tools to mitigate risks.
• Digital Forensics:Assess digital evidence from computer security incidents to derive useful information in support of system and network vulnerability mitigation.
• Incident Response:Investigate, assess, and respond to network cybersecurity incidents.
• Infrastructure Support:Test, implement, deploy, maintain, and administer infrastructure hardware and software for cybersecurity.
• Insider Threat Assessment:Identify and assess the capabilities and activities of cybersecurity insider threats; produce findings to help initialize and support law enforcement and counterintelligence activities and investigations.
• Threat Assessment:Collect, process, assess, and disseminate cybersecurity threat assessments; develop cybersecurity indicators to maintain status awareness of the highly dynamic operating environment.
• Vulnerability Assessment:Assess systems and networks to identify deviations from acceptable configurations, enclave policy, or local policy; measure effectiveness of defense-in-depth architecture against known vulnerabilities.
• Cybercrime:Investigate cyberspace intrusion incidents and crimes; apply tactics, techniques, and procedures for a full range of investigative tools and processes and appropriately balances the benefits of prosecution versus intelligence gathering.
• Digital Evidence Assessment:Identify, collect, examine, and preserve digital evidence using controlled and documented analytical and investigative techniques.
• Systems Testing and Evaluation:Plan, prepare, and execute system tests; evaluate test results against specifications and requirements; and report test results and findings.
• Cybersecurity Architecture:Ensure that security requirements are adequately addressed in all aspects of enterprise architecture, including reference models, segment and solution architectures, and the resulting systems that protect and support organizational mission and business processes.
• Performs other related duties as needed; schedules, hours and locations may fluctuate based on business needs.

• Bachelor's degree in Cybersecurity, Information Security, Information Technology or closely related field (i.e. Computer Science, Systems Engineering, Electrical Engineering), or equivalent experience. If no degree, seven or more (7+) years of relevant experience is required.

• Three or more (3+) years of progressively relevant professional or technical experience in cybersecurity and/or information security.

• One or more (1+) professional certification with an emphasis on Cybersecurity, Information Security, Security and/or Network Administration, or Audit (e.g., CompTIA Security+, GSEC, GFACT, CISF, GISCP, CEH, and CPEN) is required, or an industry recognized certification must be obtained within one year of hire and maintained.

Practices of system security engineering, design, development, analysis, testing and security administration. Methods and techniques of evaluating security and privacy requirements and developing secure solutions for SMUD systems. Methods and techniques of developing data security, integrity, backup and recovery processes. Project management methodologies. Principles and practices of systems and procedures analysis and design. English composition and business writing and vocabulary standards; methods and techniques for report preparation and writing; methods and techniques for record keeping; modern office practices and procedures.

Troubleshoot, evaluate and problem solve; learn new skills quickly with minimal guidance; achieve project schedules and milestones; work in a team environment with aggressive deadlines and multiple priorities while remaining a team player; facilitate and present; demonstrate strong verbal and written communication skills as well as strong interpersonal skills; listen, learn, speak up, and mentor; demonstrate attention to detail; work with different groups and on diverse projects as a partner; perform privacy and/or security reviews including regulatory and industry assessments, risk assessments, information inventory and data mapping, vendor management security assessments, and additional privacy or cybersecurity compliance related projects.

• Knowledge of cybersecurity and privacy principles.
• Knowledge of cloud cybersecurity best practices.
• Knowledge of container technology and best practices.
• Strong understanding of cyber threats and vulnerabilities.
• Ability to accurately define incidents, problems, and events in the trouble ticketing system.
• Ability to operate common network tools (e.g., ping, traceroute, nslookup).
• Ability to monitor measures or indicators of system performance and availability.
• Ability to apply cybersecurity and privacy principles to organizational requirements (relevant to confidentiality, integrity, availability, authentication, non-repudiation).
• Advanced level knowledge of computer networking concepts and protocols, and network security methodologies.
• Knowledge of specific operational impacts of cybersecurity lapses.
• Knowledge of information technology (IT) security principles and methods (e.g., firewalls, demilitarized zones, encryption).
• Knowledge of operating systems.
• Knowledge of security system design tools, methods, and techniques.
• Knowledge of server and client operating systems.
• Knowledge of systems administration concepts.
• Knowledge of virtualization technologies and virtual machine development and maintenance.
• Knowledge of operating system command-line tools.
• Knowledge of how to use network analysis tools to identify vulnerabilities.