Job Description

• Deep Knowledge in: o CIS Benchmarks and controls. o Relevant OS –
• Primarily Windows 11/Server 2022, Microsoft 365
• Edge/Chrome/Firefox Browsers, Microsoft SQL Server also preferred o Active Directory Group Policy
• Knowledge of other technologies, including Redhat Linux, Cisco IOS/XE, Checkpoint Firewalls, and AWS preferred.
• Expertise in the following or similar tools: o Rapid7 InsightVM o Regular Expressions
• Background: o Related work experience to provide perspective to compare to similar efforts at other organizations o Ability to explain system behavior to stakeholders to help understand downstream operational impacts Scope:
• Work directly with various internal stakeholders to understand our current state of hardening compliance with CIS benchmarks. Using internal project management to coordinate scheduling and availability.
• Work with stakeholders to identify controls that can/should be risk accepted while providing effective challenge with a security-first mindset.
• Provide suggestions on how to streamline scanning, control enforcement, remediation efforts, and future migrations to newer versions of benchmarks.
• Provide assistance with testing and/or troubleshooting of controls. For example, being an escalation point to help identify if an issue is related to a control setting or not.
• Provide feedback or suggestions on compliance metrics reporting.

Deliverables:

• Perform a gap analysis on current controls that are failing and prioritize remediation efforts based on greatest security benefit.
• Provide Project reporting to the project sponsor as required.
• Create implementation plan/Project Plan to improve various system hardening compliance with CIS level 1 benchmarks
• Implement the system hardening controls such that we achieve 100% compliance (excluding exceptions) by April 30, 2027.
• Relevant CIS Benchmarks include Windows 11/Server 2022, Redhat Linux, Cisco IOS/XE, Checkpoint Firewalls, Microsoft SQL Server, Edge/Chrome/Firefox Browsers, Microsoft 365 Foundations, and AWS Foundations.

Classification: Internal Classification: Internal

Classification: Internal Classification: Internal

Classification: Internal Classification: Internal