The Director of Information Security Operations is responsible for two key pillars in the Information Security Program: Incident Response / Investigation and Identity Access Management. The director will provide guidance and oversee all security investigations related to network computer intrusions and other assignments relating to advancing the cyber investigation and response practice. This role is responsible for supporting the development of Incident Response (IR) tools, development of IR and cyber security protocols, development of advanced network intrusion detection protocols, and information and intelligence sharing with other Wynn security operations. The director will further oversee the department responsible for provisioning, de-provisioning, transfers, delegated administration, and access automation of user accounts utilized by Wynn employees.
Job Responsibilities:- Develops strategies to investigate security incidents, access problems, network intrusions and other cyber security events to determine the cause and extent of the incident.
- Research, develop, and recommend hardware and software needed for Incident Response and develop procedures and response plans to maintain business operations.
- Participate in technical meetings and working groups to address issues related to malware security, vulnerabilities, and issues of cyber security and preparedness.
- Leads the development of policies, standards, and procedures related to access security and incident response.
- Thoroughly investigate instances of malicious code to determine attack vector and payload.
- Develop high performance, false positive free, signature-based network level, and malware detection schemes.
- Participate in special forensic investigations as required, including collection, preservation of electronic evidence.
- Preserve and analyze data from electronic data sources, including laptop and desktop computers, servers, and mobile devices.
- Preserve, harvest, and process electronic data according to the department’s policies and practices on an as necessary basis.
- Recommend improvements, corrections, remediation for associated engineering projects or current internal processes.
- Oversees the workflow within IAM including access provisioning, compliance, access management (including privileged accounts) and other functions in Information security.
- Plan and manage Access Certification, RBAC & SoD related initiatives.
- Guide application administration teams in configuring application security to leverage Single Sign-On (SSO) where available and to meet company identity standards.
- Communicate IAM security risks and solutions to business units and executives.
