Lead, Cyber Security

Overview

A Foot Locker Cyber Risk Specialist is responsible for driving the corporate vulnerability management program and managing risk to the organization. Your role involves identifying, assessing, and mitigating potential vulnerabilities within our systems, applications, and networks. We are seeking a meticulous professional with an understanding of NIST frameworks and ISO 27000 series, to ensure the highest standards of security. Define a reporting cadence and conduct periodic evaluations of risk decisions associated with prior documented risk exceptions. Additionally, track and report any vulnerabilities that exceed SLAs to drive the exception and risk escalation process.

Your day-to-day activities involve conducting thorough vulnerability assessments and risk identification, employing innovative tools and methodologies. However, your impact goes beyond identification; you will work together with IT (Information Technology), development, and security teams to ensure the swift and strategic remediation of vulnerabilities. Your ability to prioritize risks based on severity and potential impact will be paramount, guiding the organization in making informed decisions about mitigation efforts.

Responsibilities

Collaborate closely with cross-functional teams, including IT and development, to facilitate the timely remediation of identified vulnerabilities.Maintain the organizational cyber risk register. Define processes to support effective risk management and reporting.Prioritize vulnerabilities based on risk and potential impact, ensuring a strategic approach to mitigation efforts.Analyze cyber risks and prioritize vulnerabilities based on potential impact and likelihood, ensuring alignment with ISO 27000 series, NIST800-53, 800-137, and 800-60 guidelines.Evaluate risks associated with 3rd party vendors by assessing their cybersecurity maturity.Develop and maintain a comprehensive vulnerability management program that aligns with organizational goals and regulatory requirements.Create detailed and insightful reports on vulnerability assessments, offering actionable recommendations for risk mitigation.Conduct root cause analysis of security incidents and recommend corrective actions based on vulnerability and risk data.Stay actively involved in industry forums and communities to stay ahead of emerging threats and vulnerabilities.Utilize automated tools to identify critical flaws in corporate systems and determine priority and criticality of vulnerability remediation based on analysis.Work with business partners to make recommendations and provide guidance for remediation.Compile and track vulnerabilities over time for metrics purposes.Follow established process and procedure in use and support of operational software tools, hardware, and system software.Be willing and capable of learning new tools and processes.Participate in threat hunting, threat modeling, and threat intel activities.Adhere to all corporate security policies and standards as they relate to job duties.

Qualifications

SKILLS & KNOWLEDGE

Experience with vulnerability scanning tools and penetration testing methodologies. Proficient understanding of NIST 800-53, 800-137, and 800-60 frameworks. Strong knowledge of network protocols, systems, and applications. Familiarity with risk assessment and mitigation strategies. Excellent analytical and problem-solving skills. Effective communication and collaboration abilities. Up-to-date knowledge of cybersecurity threats and trends. Must have experience with automated vulnerability scanning tools. (Network, System, Static/Dynamic code analysis.) Must understand the OWASP Top 10 and Proactive controls. Must demonstrate the ability to professionally communicate in verbal and writing skills. Must understand basic security principles with an understanding of malware, cryptography, threats and vulnerabilities, access control, and application, data, and host security. Must understand core networking (TCP/IP, routing, switching, wireless) and the OSI model. Must understand basic use of both Windows 7/10/Server 2008/2012 and Linux, including console level commands. Must demonstrate skills and interest in supporting a variety of security systems such as SIEM, IDS/IPS, firewalls, proxies, host security software, and vulnerability scanners.

Minimum Qualifications

An associate’s degree from an accredited university or college with course work in Information Security, Information Management Systems, or Networking.

OR

Completion of non-accredited coursework through related on-the-job training, AND a minimim of 6 years full-time experience in an IT role.Proven experience in vulnerability management or a similar role.

Preferred

Certified Information Systems Security Professional (CISSP).Certified Ethical Hacker (CEH).GIAC Continuous Monitoring ( GMON )GIAC Certified Incident Handler (GCIH)

Benefits

The annual base salary range is $90000 - $130000 / year. This range represents the anticipated low and high end of the salary for this position. This role is also eligible to receive short term incentives that align with individual and company performance. Salary will be determined by the education, experience, knowledge, skills, and abilities of the applicant, internal equity, and alignment with market data. Salary is one component of the Foot Locker, Inc. total compensation package, which includes the below.

Foot Locker Benefits

Employee DiscountPaid Time OffMedical | Dental | Vision Coverage401(k) | Roth 401(k)Stock Purchase PlanLife InsuranceFlexible Spending AccountOpportunities for AdvancementTuition Reimbursement for Qualified CoursesStrong Company CultureEmployee Resource Groups