IT Security Engineer

At First Fidelity Bank, people matter, including our customers, our communities, and especially our employees.

We are looking for talented, service-minded individuals who want to grow their careers in a supportive, relationship-focused environment. Our team members are essential to our success, and we invest in them through training, development, and opportunities to advance. One of our core values is providing a caring place to work where people enjoy coming to work, build lasting relationships, and feel proud of the difference they make every day.

This is not a remote position. It is on-site in Oklahoma City.

SUMMARY
Reporting to the Chief Technology Officer, the IT Security Engineer supports the Bank with the development, implementation, and maintenance of a strategic and comprehensive enterprise-wide Information Security/Cybersecurity Program designed to ensure proper protection of the Bank’s data, systems, information assets, intellectual property, and the Bank’s reputation.

PRIMARY DUTIES/RESPONSIBILITIES

Please note this job description is not designed to cover or contain a comprehensive listing of activities, duties or responsibilities that are required of the employee for this job. Duties, responsibilities, and activities may change at any time with or without notice.

• Under the guidance and direction of the Chief Technology Officer, oversees the management and operations of information security and cybersecurity tools, documentation, standards, and processes to ensure an operating environment that is effective, sound, secure, sustainable, scalable, and compliant with Bank policies and regulatory requirements.
• Provides information and cyber risk guidance for IT projects, including the evaluation and recommendation of technical controls and security policies and procedures. Monitors developments and trends in information security and cybersecurity and formulates strategy accordingly.
• Works with key individuals throughout the organization to develop business cases for new security projects and risk assessments of existing and planned information systems. Supports a proactive culture to align activities and measurement with internal policy and regulatory requirements.
• Fosters collaborative and cooperative working relationships with security stakeholders, including IT team members, executive leadership, operations, business lines, risk management, and internal audit.
• Prepares and presents accurate and timely information in response to audits and regulatory exams. Develops effective relationships with the internal audit department.
• Provides support and collaborative mentorship to the IT team on information security and cybersecurity matters. Supports IT team members on escalations of security incidents by providing subject matter expertise and guidance.
• Provides leadership and technical and administrative support for the bank’s disaster recovery and business continuity program and implements appropriate and effective controls to mitigate identified risks and threats.
• Responds to potential threats such as phishing, malware, and network attacks with a detailed written assessment, including timelines, to assist in the determination of whether it is necessary to declare a security incident.
• Under the direction of the Chief Technology Officer, leads incident response to security events with a high degree of personal accountability. Utilizes incident response procedures and workflows for triage, analysis, notification, escalation, containment, remediation, and reporting.
• Monitors access to all systems and maintains access control profiles on the network and systems. Tracks documentation of access authorization to all IT resources.

• Installs, modifies, enhances, and maintains data system security software and performs application/network penetration tests and firewall auditing.
• Supports improved security awareness, including awareness and development of controls and detection solutions to address malware, cybersecurity, and advanced or persistent attacks.
• Supports a continuous monitoring framework by effectively reporting the Key Risk Indicators (KRIs) and Key Control Indicators (KCIs).

• Assists with penetration testing, results analysis, recommendations, remediation planning and implementation, and reporting.
• Provides after-hours and weekend analysis on an as-needed basis outside of general working hours.
• Other duties as assigned by the Chief Technology Officer. Regular and reliable attendance is a requirement of the job.