Information Technology Manager

Flex

Timișoara, Romania

Job Summary

The IT Manager role is required to act as the regional cybersecurity Digital Forensics & Incident Response (DFIR) manager leading response teams formed during an identified cybersecurity incident/case. The manager will handle large scale incidents, events or investigations requiring cross-team coordination and communication.

What a typical day looks like

You will coordinate the response to cyber security incidents; following standard incident response phases: prepare, identify, contain, eradicate, recover, lessons learned;
You will perform cybersecurity incident response triage and handling by determining scope, urgency and potential impact to Flex; thereafter identifying the specific vulnerability and recommending actions for expeditious containment, eradication, remediation/recovery;
Investigating escalated incidents using all available information from Flex information technology systems and security systems such as OS logs, application logs, firewall, IPS, sand boxing, host security, network devices, vulnerability management, compliance management, DLP and network forensics;
You will establish oversight of cybersecurity incidents and communicate analysis, containment, and remediation efforts to all involved business partners; escalating incidents to management in a timely manner with appropriate information regarding risk, action times, and root cause analysis;
You will determine the root cause of incidents and work with business or technology groups to remediate any identified control gaps or failures;
Preserving, harvest, process, and analyze electronically stored information (ESI) from various electronic data sources such as laptops, desktops, servers, and small form factor mobile devices according to policies, procedures, and best practices;
Continually develop cybersecurity policies and procedures documentation related to cybersecurity incident response. Create and maintain policies, procedures, guidelines, and lead projects that ensure continued compliance with all applicable corporate policies, procedures, state and federal laws and regulations;
You will maintain a high level of professionalism in all areas of performance;
You will maintain proficiency with industry standard cybersecurity incident response tools and practices; evaluation of the same;
Developing and broaden cybersecurity incident response skill set through training, industry collaboration, and research;
Attending and presenting in-house training and awareness of Global Cybersecurity policies and procedures.

The experience we’re looking to add to our team

Bachelor's Degree in Computer Science or related field;
Ten years of experience in Information Technology or related field;
Five years of relevant information security, audit, risk, privacy, compliance or other relevant experience in manufacturing, supply chain management, technology or combination of education and relevant experience;
Experience with digital forensics processes and core principles such as evidence identification, seizure, chain of custody, network acquisition and triage;
Experience with NIST Cybersecurity framework, Lockheed Martin Cyber Kill Chain ®, ISO27035, and/or recognized Cybersecurity Incident Response Team (CSIRT) models.

Here are a few of our preferred experiences

Mastery of incident response methodologies, best practices and routines;
Mastery at directing and coordinating technical response teams to develop quick containment solutions to cybersecurity incidents;
Expert at identifying various types of events and incidents and applying the right response framework for each (i.e. information mishandling, security vulnerability, system exploit, malware infection, etc.);
Advanced technical and overall understanding of computer systems, operating systems, enterprise networks and associated hardware and software;
Understanding of the concepts surrounding digital evidence, and its impact on cybersecurity incident response, investigations and legal activity applicable to their regions;
Understanding of digital acquisition concepts, including but not limited to, creating a forensically sound copy of data and evidence from seized media, and verification of the evidence to demonstrate validity/integrity. Ability to use digital forensic devices, and evidence acquisition hardware/software;
Highly effective written, oral and interpersonal communication skills to address a wide variety of sophisticated audiences with the ability to produce high quality oral and written work product presenting complex technical matters clearly and concisely;
Demonstrate professionalism, discretion and judgment through sound decision making to obtain solutions via collaborative efforts with a wide variety of departments and personnel throughout the company;
Ability to travel internationally (approximately 40%);
Good to have certifications : Certified Information Systems Security Professional (CISSP), preferred; EnCase Certified Examiner (EnCE), preferred; certified Fraud Examiner (CFE); Certified Ethical Hacker (CEH); Global Certified Incident Handler (GCIH); Microsoft Certified Systems Engineer (MSCE); Certified Secure Software Lifecycle Professional (CSSLP) and/or any related SANS coursework.