To apply, please visit the IMF Careers page (www.imf.org/jobs) and apply for Job Number 1900300. The deadline to apply online is July 24, 2019. The International Monetary Fund (IMF) is seeking an Information Security Officer (Assurance Manager) to join its IT Department (ITD) located in Washington DC This is a contractual position for one (1) year renewable for up to four (4) years of cumulative contractual service pending incumbent's performance and continued business need. Job Summary: Under the general supervision of the Chief Information Security Officer (CISO), the Information Security Officer - Assurance Manager will provide security expertise and support of the IMF's independent cyber resiliency assessment initiatives. The expertise will take the form of independently and continuously assisting with the: technical validation of the IMF's resilience against offensive cyber security tactics and techniques (which emulate the IMF's cyber adversaries); and non-technical assessments of the IMF's cyber resilience and cybersecurity practices. The candidate will be required to work with IT personnel, service providers and business units internal and external to the Fund's IT function. Responsibilities: Provide assistance with the following: Execution of cyber resilience assessment activities which includes: penetration testing, red/purple teaming exercises, cybersecurity tabletop exercises, social-engineering assessments, security assessment of infrastructure (wireless access points, firewall, routers, operating systems etc.) Develop adversary emulation plans by leveraging input from the IMF's cyber threat intelligence function. Such input includes characterization of the adversary's cyber capabilities; research on the structure, ideology, intentions, tactics, and capabilities of adversarial cyber organizations. Use adversary emulation plans to determine and define adversary cyber courses of action to be used in the execution of cyber resilience assessment activities. Develop courses of action that a cyber adversary might employ against IMF personnel, equipment, networks, information and information systems, infrastructure, and supply chains. Develop a comprehensive understanding of the cyber implications of security control gaps identified during cyber resilience assessment activities and determine associated risk and impact to the organization. Provide written and verbal descriptions of the security control gaps identified, articulate risk and impact. Provide guidance on risk mitigation strategies for the control gaps. Assist in developing methodologies for continuous enhancements to cyber resilience assessment methods and processes. Document and facilitate reporting to various Business and Technical teams. Provide analysis, guidance, prioritize actions, and track resolution. Develop, research, and maintain proficiency in tools, techniques, countermeasures, and vulnerability trends ranging from data compromise/destruction, covert communications, encryption attacks and more. Advice on cyber security best practice techniques to address weaknesses in cyber assets and combat sophisticated threats against those assets. Assist with the development of reports and presentations and other necessary documents to convey assessment findings to stakeholders. Skills: Candidate must have experience with the following: Executing enterprise-wide cybersecurity assessments, including a knowledge of control strategies for a global organization. Conducting red team and war gaming/cybersecurity tabletop exercises to challenge security strategy and effectiveness. Must be able to examine an organization from the standpoint of a threat actor and articulate risk in clear terms. Experience in one or more of: cyber operations, red-teaming, penetration testing, exploitation, cybersecurity research and development. Experience performing penetration testing & vulnerability assessments of web application and infrastructure environments. Strong consultative skills required to work directly with other technology teams with appropriate influence. Manage and deliver large projects by developing the project team, assessing engagement risks throughout, driving conclusions, and reviewing/challenging the output produced by the team. Passion for protecting networks, systems and data from cyber-attacks. Strong written and verbal communication skills. Interpersonal skills that create openness and trust among colleagues. Facilitation and conflict management skills that enable effective working relationships. Spoken and written communications that are compelling, convincing and reassuring, and skills to articulate complex technical ideas to non-technical stakeholders. Excellent relationship management skills. Knowledge Requirements: Knowledge of advanced cyber threats and adversary methodologies eg MITRE ATT&CK (TM) framework. Knowledge of red teaming frameworks and their uses within the cybersecurity community eg TIBER-EU. Demonstrated knowledge of tactics used by malicious insiders, techniques and procedures associated with state sponsored threat actors. Deep understanding of penetration testing and red teaming frameworks and concepts. Strong understanding of cybersecurity concepts and related technology solutions. Programming experience in one or more languages such as Python, Ruby, Perl, Bash, Java. Advanced knowledge of operating and database security (Windows, UNIX/Linux, SQL, Oracle, etc.) Qualifications: Educational development, typically acquired through the completion of an advanced university degree in information security, computer science, engineering, mathematics or related field of study or equivalent, plus a minimum of 6 years of relevant professional experience; or a bachelor's degree in information security, computer science or a related field of study plus a minimum of 12 years of relevant professional experience, is required. Certifications: Candidate must possess at least 2 of the certifications below. Having more than 2 of them and other hands-on technical information security certifications, is a plus. CISSP CEH GIAC certifications in the Penetration testing category GIAC - GSNA OSCE or OSCP+OSWE