Staff Security Engineer
Burbank, CA

Job Description

Job Description

The Walt Disney Studios is comprised of large team of creative professionals who produce, manage, and distribute live-action and animated motion pictures that tell memorable, life changing stories. Few media and entertainment companies can rival the

brands we have the honor of bringing to the world.

As part of the Studio Technology team you'll be joining a group of passionate, dedicated technologists solving a range of interesting problems in innovative ways in an exciting and dynamic industry.

The security engineering professional at the Studio brings expertise and innovation to design, implement and maintain solutions and technologies that address cyber security challenges and opportunities. This might include threat-based engineering, new architectures, tools, and training.

The Staff Security Engineer will prototype, perform product evaluations, and develop test plans for systems and networks. This includes performing research and development of unique, cutting edge technical capabilities for understanding, assessing, and analyzing cyber technologies.

Job Type

Full Time

Segment

Studio Entertainment

Category

Security

Basic Qualifications

* 7 years experience with 3 or more areas including: public cloud, private cloud, secure application development, virtual network big data, elastic compute, cloud security
* 5 years of practical cloud information security experience or equivalent
* Experience in information management and information technology security design and implementation
* Demonstrated experience with security event logs from Windows, Unix, intrusion detection systems, network, and remote access solutions
* Experience with both commercial and open source tools such as Kali, burp, nmap, Nessus, Aquasec, sqlmap, metasploit, meterpreter, kismet, fiddler, wireshark, and Aircrack-ng
* Experience managing IDS / IPS / firewall systems in distributed/hybrid cloud environment
* Demonstrated experience in creating conceptual, logical and physical security diagrams, thorough understanding of vulnerabilities and countermeasures
* Information Security technology/compliance experience
* Detailed understanding of TCP/IP and related communication protocols, Windows authentication mechanisms (Kerberos, NTLM, AD), networking technologies, software defined computing, containerization, routing and switching, big data, elastic compute, and risk analysis and risk management methodologies
* Ability to manage multiple priorities and work effectively in a fast-paced, high volume, results driven environment
* Excellent written and verbal communication skills including reporting
* Knowledge of API design
* Knowledge of Directories such as Active Directory & Virtual Directory, Federation & other authentication/authorization technologies
* Multiple scripting languages in your toolbox (e.g. Python, GO, PERL, or Swift)
* Exceptional analytical and problem solving skills
* Strong oral and written communication skills
* Ability to establish credibility and working relationships with a wide range of personnel, including operations, management and legal staff
* Knowledge of tools and techniques for analyzing large sets of data
* Demonstrated experience using various log sources, as well as internal and external threat intelligence, to identify emerging threats
* Demonstrated strong organizational and time management skills

Business

The Walt Disney Studios

Required Education

* Bachelor's degree in Computer Science or Information Security related field or equivalent work experience testing information systems.

Preferred Qualifications

* Conceptual knowledge of reverse malware processes and tools
* Conceptual knowledge of cloud providers and cloud security best practices
* Conceptual knowledge of SIEM solutions such as Splunk and QRadar
* Two or more senior Information Security and cloud certifications: CISSP, CCSP, AWS Certified Public Cloud Architect, MCSE cloud, VMWare VCP6 cloud, EMCCA cloud computing Architect or GIAC)
* Ability to be flexible with work schedule and travel requirements

Postal Code

91521

Responsibilities

* Facilitates vulnerability management program across various systems, network, and production engineering groups
* Evaluate, design and deploy system scanning and penetration testing solutions
* Evaluate, design and deploy encryption technologies, processes and procedures
* Ensure systems are designed in accordance with and are aligned with Disney security requirements; includes architecture assessments, secure development training, and conducting RTOs
* Partner with the Studio Information Security and Content Protection team to develop technical monitoring, assessment and response solutions
* Prepare, review, and present reports (e.g., penetration test results, incident response metrics, forensics, network monitoring metrics), position papers, assessment recaps to team (peers) and next level of leadership within team
* Executes advanced risk and threat analysis activities, leveraging learnings from external and internal cyber trends and incidents
* Build and deliver services, solutions and processes that enable security defects to found, fixed or avoided before applications are released to production

Job Description

The Walt Disney Studios is comprised of large team of creative professionals who produce, manage, and distribute live-action and animated motion pictures that tell memorable, life changing stories. Few media and entertainment companies can rival the

brands we have the honor of bringing to the world.

As part of the Studio Technology team you'll be joining a group of passionate, dedicated technologists solving a range of interesting problems in innovative ways in an exciting and dynamic industry.

The security engineering professional at the Studio brings expertise and innovation to design, implement and maintain solutions and technologies that address cyber security challenges and opportunities. This might include threat-based engineering, new architectures, tools, and training.

The Staff Security Engineer will prototype, perform product evaluations, and develop test plans for systems and networks. This includes performing research and development of unique, cutting edge technical capabilities for understanding, assessing, and analyzing cyber technologies.

Basic Qualifications

* 7 years experience with 3 or more areas including: public cloud, private cloud, secure application development, virtual network big data, elastic compute, cloud security
* 5 years of practical cloud information security experience or equivalent
* Experience in information management and information technology security design and implementation
* Demonstrated experience with security event logs from Windows, Unix, intrusion detection systems, network, and remote access solutions
* Experience with both commercial and open source tools such as Kali, burp, nmap, Nessus, Aquasec, sqlmap, metasploit, meterpreter, kismet, fiddler, wireshark, and Aircrack-ng
* Experience managing IDS / IPS / firewall systems in distributed/hybrid cloud environment
* Demonstrated experience in creating conceptual, logical and physical security diagrams, thorough understanding of vulnerabilities and countermeasures
* Information Security technology/compliance experience
* Detailed understanding of TCP/IP and related communication protocols, Windows authentication mechanisms (Kerberos, NTLM, AD), networking technologies, software defined computing, containerization, routing and switching, big data, elastic compute, and risk analysis and risk management methodologies
* Ability to manage multiple priorities and work effectively in a fast-paced, high volume, results driven environment
* Excellent written and verbal communication skills including reporting
* Knowledge of API design
* Knowledge of Directories such as Active Directory & Virtual Directory, Federation & other authentication/authorization technologies
* Multiple scripting languages in your toolbox (e.g. Python, GO, PERL, or Swift)
* Exceptional analytical and problem solving skills
* Strong oral and written communication skills
* Ability to establish credibility and working relationships with a wide range of personnel, including operations, management and legal staff
* Knowledge of tools and techniques for analyzing large sets of data
* Demonstrated experience using various log sources, as well as internal and external threat intelligence, to identify emerging threats
* Demonstrated strong organizational and time management skills

Required Education

* Bachelor's degree in Computer Science or Information Security related field or equivalent work experience testing information systems.

Preferred Qualifications

* Conceptual knowledge of reverse malware processes and tools
* Conceptual knowledge of cloud providers and cloud security best practices
* Conceptual knowledge of SIEM solutions such as Splunk and QRadar
* Two or more senior Information Security and cloud certifications: CISSP, CCSP, AWS Certified Public Cloud Architect, MCSE cloud, VMWare VCP6 cloud, EMCCA cloud computing Architect or GIAC)
* Ability to be flexible with work schedule and travel requirements

Responsibilities

* Facilitates vulnerability management program across various systems, network, and production engineering groups
* Evaluate, design and deploy system scanning and penetration testing solutions
* Evaluate, design and deploy encryption technologies, processes and procedures
* Ensure systems are designed in accordance with and are aligned with Disney security requirements; includes architecture assessments, secure development training, and conducting RTOs
* Partner with the Studio Information Security and Content Protection team to develop technical monitoring, assessment and response solutions
* Prepare, review, and present reports (e.g., penetration test results, incident response metrics, forensics, network monitoring metrics), position papers, assessment recaps to team (peers) and next level of leadership within team
* Executes advanced risk and threat analysis activities, leveraging learnings from external and internal cyber trends and incidents
* Build and deliver services, solutions and processes that enable security defects to found, fixed or avoided before applications are released to production