ITS services range from: establishing the infrastructure to reach and connect staff and development stakeholders; providing the devices and agile technology and information applications to facilitate the science of delivery through decentralized services; creating and maintaining tools to integrate information across the World Bank Group, the clients we serve and the countries where we operate; and delivering the computing power staff need to analyze development challenges and identify solutions.
The ITS business model combines dedicated business solutions centers that provide services tailored to specific World Bank Group business needs and shared services that provide infrastructure, applications and platforms for the entire Group. ITS is one of three VPUs that have been brought together as the World Bank Group Integrated Services (WBGIS), to provide enhanced corporate core services and enable the institution to operate as one strategic and coordinated entity.
The ITS Information Security and Risk Management (ITSSR) unit, headed by the Chief Information Security Officer (CISO), is responsible for providing leadership in managing the functions and activities of information security and risk across the World Bank Group, enabling the achievement of WBG’s business objectives. ITSSR enables and facilitates a risk aware culture, ensures that WBG information assets are protected in an effective, efficient, and balanced manner; and IT security and risk management efforts throughout the World Bank Group are coordinated and aligned to the Bank’s business and IT strategy. ITSSR establishes and maintains the World Bank Group’s IT and InfoSec policies and standards; develops and engineers the WBG’s information security plans and solutions; responds to security incidents; and ensures that the information risks are identified, assessed, and managed in consistent with the overall risk management approach and with the established appetite and tolerance. ITSSR consists of three main units: 1) ITS Risk Management, Compliance, and Policy, 2) ITS Security Operations, and 3) Program Management Office (PMO).
Note: If the selected candidate is a current Bank Group staff member with a Regular or Open-Ended appointment, s/he will retain his/her Regular or Open-Ended appointment. All others will be offered a 3 year term appointment.
Scope of Work
• Provide Information Security Operations Center (ISOC) support on a 24x7x365 basis by shift work with rotation
• Monitor multiple security alert sources, eliminate false positives, based on impact and nature of the Security incident triage significant security events and escalate according to the established procedures
• Review automated daily security reports of key security controls, identify anomalies and, escalate critical security events to the appropriate stakeholders and follow-up as required.
Security Incident Response
• Conduct thorough investigative actions based on security events and remediate as dictated by standard operating procedures.
• Participate in all the phases of security incident response process, including detection, containment, eradication, and post-incident reporting.
• Record detailed Security Incident Response activities in the Case Management System.
• Wherever required perform memory forensics.
• Analyze, evaluate, and document malicious code behavior. Analysis will include static and dynamic analysis using industry standard tools and techniques, identifying exploit methods and targeted vulnerabilities where applicable.
• Ensure the accuracy and integrity of information throughout reporting.
• Participate in directed research and development tasks.
• Enhance and develop tools to identify unknown malware (including zero-day) using various characteristics of a file format including structure and location.
• Assist the ISOC lead in developing and setting up frameworks for developing Security incident response toolkit.
• Act in the Shift Supervisor role when required, running the shift and assuming the shift leader responsibilities. This activity will require management of the level 1 & 2 Security incident handlers and acting as a final authority for technical expertise and escalation of Security Incidents.
• Minimum 5 years of Information Security experience required;
• Out of which the individual has worked with CSIRT for a minimum period of 2 years
• Understanding of how operating systems work and how malware exploits them.
• Understanding of network traffic and be able to analyze network traffic introduced by the malware.
• Thorough understanding of Windows Internals and memory management.
• Knowledge of common hacking tools and techniques
• Experience in understanding and analyzing various log formats from various sources.
• Experience in analyzing reports generated of SIM/SEM tools
• Proficient experience with the following concepts and related toolsets:
o Network sniffers
o Process analysis tools
o Registry analysis tools
o File analysis tools
o Memory analysis tools
• GIAC Certified Intrusion Analyst (GCIA) or GIAC Certified Incident Handler (GCIH)
• GIAC Certified Forensics Examiner (GCFE), GIAC Certified Forensic Analyst (GCFA), GIAC Reverse Engineering Malware (GREM)
• Client Understanding and Advising – Looks at issues from the client’s perspective and takes action beyond normal expectations to ensure client satisfaction.
• Learning Orientation – Stays abreast of new trends and developments in own specialty area, the broader industry, and exposes self to increasingly more challenging projects and opportunities to learn.
• Broad Business Thinking – Maintains an in-depth understanding of the long term implications of decisions both for department and the client’s business. Ensures that decisions are supported by relevant stakeholders as well as sound performance data.
• Compliance with Standards – Monitors and maintains records on requests for information and assistance.
• Information Systems / Technologies / Product / Services Knowledge – Resolves escalated problems of technical support.
• Knowledge of Emerging Technology – Tests new technology to evaluate capability compared to specifications.
• Negotiation – Investigates areas of disagreement.
• Risk Management – Reduces risk by solving day-to-day problems as they arise and takes action to prevent problems from recurring.
• Lead and Innovate – Brings new and different insights.
• Deliver Results for Clients – Contributes to delivery of results for clients on complex issues.
• Collaborate Within Teams and Across Boundaries – Collaborates within team and across boundaries.
• Create, Apply and Share Knowledge – Actively contributes to and readily applies WBG’s body of knowledge for internal and/or external client solutions.
• Make Smart Decisions – Leverages available data and makes timely decisions.