Senior Security Evaluator

Company Description

SGS is the global leader and innovator in inspection, verification, testing and certification services. Founded in 1878, SGS is recognized as the global benchmark in quality and integrity. With over 97,000 employees in 130 countries and operating a network of more than 2,400 offices and laboratories, we provide services to almost every industry by assuring quality and safety of products and services.

Trusted all over the world, SGS is a market leader because we put 100% passion, pride and innovation into everything we do. We encourage new ideas. We welcome people who challenge the way we do things. And we will be 100% committed to helping you reach your full potential.

Job Description

A senior engineer must be well versed in, but not limited to, operating systems, data structures, design/analysis of algorithms, database systems, programming languages, computer systems architectures, and networking and will be responsible to work independently as well as lead teams and mentor junior engineers to conduct security compliance analysis or testing of operational, management, and technical controls for IT products, including COTS and GOTS, networks, and systems. This may include:  

• Develop test plans and procedures using applicable security control catalog, including DCID 6/3, DoD 8500, or NIST SP 800-53;  
• Perform security testing and vulnerability analysis of product or system designs against applicable security criteria using common tools such as Nessus, NMAP, and WireShark;  
• Perform other evaluation activities, including but not limited to documentation and source code analysis, where applicable;
• Develop security testing and other evaluation reports to detail the findings noted during testing and other evaluation activities;  
• Develop mitigation strategies to address vulnerabilities uncovered during security testing; 
• facilitate and coordinate development of or updates to security documentation to meet certification and authorization requirements as required;
• Work effectively and efficiently either alone and with other team members to accomplish the tasks summarized above; and,
• Work with the organization managers to help identify and implement changes that could improve the overall effectiveness of the organization.

Qualifications

Education and ExperienceEducation Requirement

• Bachelor’s degree, science or computer degree preferred.                                                        
• 5+ years of experience, training, knowledge, or familiarity in the following areas: 17CAV, 17CMH, and 17CMS                                                
• Validation Program’s programmatic guidance and management documents                               
• The cryptographic algorithms listed in FIPS 140-2 annexes            
• Random bit generators and entropy requirements
• Key establishment methods and concepts
• Specification of the module (e.g. hardware, software, hybrid, and/or firmware)
• Module ports and interfaces;
• Trusted path and direct entry methods;
• Specification of roles and services;
• Authentication methods (role and identity-based) and strengths
• Bypass mechanisms and concepts
• Finite state machine model analysis
• Development of test jigs, software debuggers, binary editors, compilers, and software diagnostic tools
• Software design specification, including high-level languages
• Operating system and concepts (e.g., Microsoft, UNIX, LINUX, ARM, Apple, etc.)
• Key management techniques and concepts
• Zeroization methods
• Key entry and output
• The cryptographic protocols, including, but not limited to, SSL, TLS, IKE, SSH, OTAR, etc.
• FCC EMI/EMC Class A and Class B requirements and intentional emitters such as radio devices
• Cryptographic self-test techniques, including, but not limited to, power-up, conditional tests, known answer tests, integrity tests, load and bypass tests, etc.
• Design assurance, such as configuration management, delivery, operation, and development
• Mitigation of other attack mechanisms
• Security policy requirements (e.g. FIPS 140-2 Appendix C)
• 17 CMH1 Security Levels 1 to 3
• Production grade, tamper-evident, and tamper detection techniques
• Hardware implementations and technologies associated with single-chip and multi-chip embodiments
• Epoxies, potting materials, adhesives (e.g. tamper-evident labels), and their chemical properties
• Electrical design, schematics, and concepts, including logic design and HDL representations
• Skills associated with tamper mitigation methods and performing test methods of compromising tamper protection mechanisms
• 17CMH2 Security Level 4
• Voltage and temperature measurement (Environmental Failure