Penetration Testing Jobs in Rochester, NY (NOW HIRING)

At CooperVision, a division of CooperCompanies, we're driven by a unifying purpose to help people to experience life's beautiful moments. We are connected through our shared values - dedicated, innovative, friendly, partners, and do the right thing. As a leading global manufacturer of contact lenses, we are committed to helping improve the way people see each day. Through our diverse lens portfolio, we tackle the toughest vision challenges - including astigmatism, presbyopia, and childhood myopia. We offer the most complete collection of spherical, toric, and multifocal products available, enabling us to fit 99% of all contact wearers. Learn more at www.coopervision.com.

• This role is not eligible for employer-sponsored work authorization now or in the future. Applicants must be authorized to work in the United States on a permanent and ongoing basis without the need for future sponsorship (i.e., H1B, STEM OPT extensions, TN, etc.)

Job Summary:

The Senior Information Security Analyst provides advanced security expertise across the enterprise to reduce risk. The role partners with engineering, compliance, audit, and business stakeholders to define and maintain security architecture, baselines, and standards; streamline remediation of vulnerabilities; and continuously improve Security Controls effectiveness.

Knowledge, Skills and Abilities:

• Expert knowledge of secutiry frameworks and concepts such as NIST 800-53, ISO 27001, CIS Critical Controls, the Cyber Kill Chain, MITRE ATT&CK, and OWASP.
• Have in-depth knowledge and understanding of information risk concepts and principles as a means of relating business needs to security controls.
• Deep understanding of enterprise infrastructure and security technologies including network switches/routers, firewalls/VPN, DLP, anti-malware, IDS/IPS, SIEM, SMTP/email security, Active Directory/Group Policy, DNS, DHCP, VLANs, and content filtering.
• Experience with traditional and modern security controls such as SIEM, IDS/IPS, PKI, IAM, antivirus/firewalls, EDR, threat intelligence, security automation/orchestration, deception, and application controls.
• Ability to conduct vulnerability scanning and penetration testing; incident response and digital forensics.
• Experience developing policies, procedures, standards, and guidelines
• Strong analytical, strategic, and tactical thinking; ability to communicate business risk effectively and drive nuanced solutions without impeding innovation.
• Understanding of common cloud platforms and how to secure them; experience with AWS and/or Azure is a plus.
• Ability to interact with Cooper personnel and build strong relationships at all levels, and across all business units and organizations, and to understand business imperatives.
• Strong leadership abilities, with the capability to develop and guide information security team members and IT operations personnel, and to work with minimal supervision.
• Excellent verbal, written and interpersonal communication skills, including the ability to communicate effectively with the IT organization, project and application development teams, management, and business personnel.

Work Environment:

• Participate in 24x7x365 on-call rotation for emergencies and escalations.

Experience:

• 5-10 years of professional IT experience; 3-6 years specifically in Information Security, including work with geographically dispersed teams.
• Experience supporting audits and meeting regulatory requirements (SOX, HIPAA, PCI, GDPR, GLBA).

Education:

• Bachelor's degree in computer science, information assurance/cybersecurity, MIS, or equivalent experience.
• Professional certifications such as GIAC (e.g., GSEC/GCIA), CISSP, CISM, Cisco Security or similar are preferred.

We are committed to equal employment opportunity regardless of race, color, ancestry, religion, sex, national origin, sexual orientation, age, citizenship, marital status, disability, gender, gender identity or expression, or veteran status. We are proud to be an equal opportunity workplace.

For U.S. locations that require disclosure of compensation, the starting base pay for this role is between $117,341 and $156,454.00 per year and may include cost of living adjustments.  The actual base pay includes many factors and is subject to change and modification in the future.  This position may also be eligible for other types of compensation and benefits.

#LI-AK1

• Provide leadership and direction for the integration of security culture and design within business and IT strategy; work with the Engineering teams to ensure that security considerations are included in systems architecture and help to identify, evaluate, and select security solutions to meet information security/compliance needs.

• Mentor and coach junior team members to develop well-rounded information security skill sets; promote a strong security culture and awareness across the organization.

• Work with compliance teams to ensure solutions meet security policies and procedures.

• Support compliance with relevant regulations and frameworks (e.g., SOX, HIPAA, PCI, GDPR, GLBA) and privacy laws; prepare for and participate in audits and examinations.

• Administer and tune security tools (e.g., SIEM, NAC, firewalls, IDS/IPS, secure email gateway) to ensure effective monitoring and detection while enabling business operations.

• Partner with Security Engineers to ensure security-by-design in systems architecture and delivery of secure solutions; participate in change/project management to validate secure designs and implementations.

• Define and maintain enterprise security documents (policies, standards, baselines, guidelines, and procedures) and provide detailed hardening guidance to technical teams.

• Prioritize vulnerability assessment output based on exploitability, impact, and likelihood; coordinate remediation across infrastructure, endpoints, applications, and cloud services.

• Support compliance with relevant regulations and frameworks (e.g., SOX, HIPAA, PCI, GDPR, GLBA) and privacy laws; prepare for and participate in audits and examinations.

• Design, scope, and lead deep technical assessments on internal and external systems.

• Define incident response playbooks for IT and Information Security personnel to follow when responding to common issues (e.g., malware infection, phishing, etc.)

• Act as a Subject Matter Expert within all Information Security disciplines.

• Coordinate and help implement significant security projects 

• Contribute to Business Continuity and Disaster Recovery planning and exercises in coordination with IT and continuity team

• Influence and communicate business risk and recommended mitigations to technical and non-technical audiences; document clearly for management and stakeholders.

• Handle sensitive/confidential information, investigations, and incidents in a professional and confidential manner.

• Perform other duties as assigned.

  Travel Requirements:  5% domestic and/or international travel