Skills Required:
- Deep Knowledge in: o CIS Benchmarks and controls. o Relevant OS
- Primarily Windows 11/Server 2022, Microsoft 365
- Edge/Chrome/Firefox Browsers, Microsoft SQL Server also preferred o Active Directory Group Policy
- Knowledge of other technologies, including Redhat Linux, Cisco IOS/XE, Checkpoint Firewalls, and AWS preferred.
- Expertise in the following or similar tools: o Rapid7 InsightVM o Regular Expressions
- Background: o Related work experience to provide perspective to compare to similar efforts at other organizations o Ability to explain system behavior to stakeholders to help understand downstream operational impacts Scope:
- Work directly with various internal stakeholders to understand our current state of hardening compliance with CIS benchmarks. Using internal project management to coordinate scheduling and availability.
- Work with stakeholders to identify controls that can/should be risk accepted while providing effective challenge with a security-first mindset.
- Provide suggestions on how to streamline scanning, control enforcement, remediation efforts, and future migrations to newer versions of benchmarks.
- Provide assistance with testing and/or troubleshooting of controls. For example, being an escalation point to help identify if an issue is related to a control setting or not.
- Provide feedback or suggestions on compliance metrics reporting.
Deliverables:
- Perform a gap analysis on current controls that are failing and prioritize remediation efforts based on greatest security benefit.
- Provide Project reporting to the project sponsor as required.
- Create implementation plan/Project Plan to improve various system hardening compliance with CIS level 1 benchmarks
- Implement the system hardening controls such that we achieve 100% compliance (excluding exceptions) by April 30, 2027.
- Relevant CIS Benchmarks include Windows 11/Server 2022, Redhat Linux, Cisco IOS/XE, Checkpoint Firewalls, Microsoft SQL Server, Edge/Chrome/Firefox Browsers, Microsoft 365 Foundations, and AWS Foundations.
Classification: Internal Classification: Internal
Classification: Internal Classification: Internal
Classification: Internal Classification: Internal