Security Architect

eu-LISA is the European Union Agency for the Operational Management of Large-Scale IT Systems in the Area of Freedom, Security and Justice (eu-LISA) manages large-scale IT systems to support the implementation of asylum, border management and migration policies in the European Union (EU). The Agency is also a front-runner for the digitalisation efforts of the EU's Justice and Home Affairs domain, building a new information architecture and contributing to the development of a new security ecosystem. Since the Agency's beginnings in 2012, eu-LISA has become the digital engine of the Schengen Area. With its activities and tasks, the Agency adds value to the EU Member States by supporting their efforts towards justice, security and freedom.

• Supports the Agency's Security Officers in developing and maintaining the security architecture of the agency in collaboration with the Enterprise Architect.
• The profile will be expected to perform the following tasks:
• Create and manage security standards, design patterns, and reference architectures
• Analyse and define security requirements for networks, corporate applications/systems , end user computing, mobility, and data center technologies and solutions
• Develop and maintain the organizational security control framework;
• Ensure that IT Security controls meet the requirements of all regulatory requirements or contractual requirements
• Work with the Security Officer and IT teams to ensure that implemented security technologies are integrated and fully utilized as intended in the protection of agency information systems.
• Monitoring and analysing trends in IT Security
• Develop strategic and detailed technical roadmaps of the enterprise security environments and the associated technologies required to deliver these solutions on a global basis.
• Develop the business, information and technical artifacts that constitute the enterprise information security architecture and solutions.
• Researches, evaluates, designs, tests, recommends and plans the implementation of new or updated information security technologies.

• Minimum 4 years of relevant education (master or equivalent) after the secondary school

• Minimum 6 years of relevant professional experience in IT security
• Minimum 4 years of professional experience in security architecture

• Expected to possess advanced knowledge of/in:
• Core domains of IT Infrastructure such as Data Networks, Server and Desktop hardware and Operating Systems, Messaging, Collaboration, Storage and Backups, and related monitoring and management systems.
• Security-specific architecture methodology, e.g. SABSA
• Security architecture models, security strategy development, and compliance management.
• Mobile Architecture, Network and Application Security and/or Data protection
• Secure development processes.
• Application Security Vulnerabilities such as OWASP Top 10, CWE/SANS Top 25 and remediation approaches
• Cybersecurity control good practice such as the SANS Top 20 Critical Controls.
• IT audit/assessment frameworks: ISO-standards; NIST, CobiT and Industry standard application development methodologies
• Enterprise authentication authorization and identity management schemes (Active directory, LDAP, etc.)
• Technical security controls such as firewalls, IDS/IPS, Vulnerability Management, web application firewalls, security gateways, WiFi, Mobile security, DLP, public key infrastructure, Encryption and Authentication techniques,
• Relational Databases, Middleware Applications, Collaboration and Document management solutions.
• XML, Web Services and SOAP protocols, both in client and server as well as dynamic languages such as Objective-C, VBScript, JavaScript
• Network and web related protocols (TCP/IP, UDP, IPSEC, HTTP, HTTPS, SMTP, SNMP, ICAP, etc.)
• Expected to possess one or more of the following qualifications:
• Certified Information Systems Security Professional with Information Systems Security Architecture Professional concentration (CISSP-ISSAP)
• Certified Information Security Manager (CISM)
• Certified Information Systems Auditor (CISA)
• TOGAF certification
• Other similar credentials