Job Description

About New York City Cyber Command

NYC Cyber Command was created in 2017 by Executive Order to lead the City’s cyber defense efforts, working across more than 100 agencies and offices to prevent, detect, respond, and recover from cyber threats. NYC Cyber Command is committed to protecting NYC infrastructure and critical systems from malicious attacks through the use of the latest technologies, public-private partnerships, and regular training and exercises for City employees.

Job Description

This position description is based on the National Initiative for Cybersecurity Education (NICE) Workforce Framework that categorizes and describes cybersecurity work across sectors using a consistent taxonomy and common lexicon. The Application Security Engineers work within Cyber Command and across City agencies to ensure compliance with cybersecurity policies and standards, and the best software and data security practices.

Duties will include:

• Analyze the security of new or existing computer applications, software, or specialized utility programs and provides actionable results in collaboration with other members of the Software Security Team;

• Application Security Engineers lead the review, coordination and conduct of the Software Security Assurance Process;

• Ensure that Software Security Assurance Process follow up tasks are executed by agencies and that appropriate risk management strategies are undertaken by application owners.

Minimum Qual Requirements

1. A baccalaureate degree, from an accredited college including or supplemented by twenty-four (24) semester credits in cyber security, network security, computer science, computer programming, computer engineering, information technology, information science, information systems management, network administration, or a pertinent scientific, technical or related area; or

2. A four-year high school diploma or its equivalent approved by a State’s department of education or a recognized accrediting organization and three years of satisfactory experience in any of the areas described in “1” above; or

3. Education and/or experience equivalent to “1” or “2”, above. College education may be substituted for up to two years of the required experience in “2” above on the basis that sixty (60) semester credits from an accredited college is equated to one year of experience. In addition, twenty-four (24) credits from an accredited college or graduate school in cyber security, network security, computer science, computer programming, computer engineering, information technology, information science, information systems management, network administration, or a pertinent scientific, technical or related area; or a certificate of at least 625 hours in computer programming from an accredited technical school (post high school), may be substituted for one year of experience.

Preferred Skills

The preferred candidate should possess the following:

– 1-2 years of experience in software security;

– Knowledge of Data Privacy Impact Assessments;

– Knowledge of web/non-web/native mobile software programming technologies (Java, C#, java script, HTML and etc) structures and logic;

– Knowledge of relational databases, web applications and services;

– Knowledge of web/non-web/native mobile system and application security threats and vulnerabilities (e.g., buffer overflow, cross-site scripting, code injections, race conditions, covert channel, replay, return-oriented attacks, malicious code);

– Knowledge of secure configuration management techniques. (e.g., Security Technical Implementation Guides (STIGs), cybersecurity best practices on cisecurity.org);

– Knowledge of software debugging principles;

– Skills in conducting software vulnerability scans (DAST, SAST and etc) and recognizing vulnerabilities in security systems;

– Skills in designing application and infrastructure countermeasures to identified security risks.

To Apply

Special Note: Taking and passing civil service exams are necessary to maintain employment with the City of New York. Please check the Department of Citywide Administrative Services (DCAS) website (http://www.nyc.gov/html/dcas/html/work/exam_monthly.shtml) for important exam filing information. Please ensure that you are either a permanent employee in the civil service title listed on this posting, or, that you file for the examination when there is an open filing period. For more information regarding the civil service process, please visit the DCAS website at: http://www.nyc.gov/html/dcas/html/work/work.shtml

* Interested applicants with other civil service titles who meet the preferred requirements should also submit a resume for consideration

For City employees, please go to Employee Self Service (ESS), click on Recruiting Activities > Careers, and search for Job ID #445734

For all other applicants, please go to www.nyc.gov/jobs/search and search for Job ID #445734

SUBMISSION OF A RESUME IS NOT A GUARANTEE THAT YOU WILL RECEIVE AN INTERVIEW

APPOINTMENTS ARE SUBJECT TO OVERSIGHT APPROVAL

DoITT Participates in E-Verify

Hours/Shift

Day – Due to the necessary technical support duties of this position in a 24/7 operation, candidate may be required to work various shifts such as weekends and/or nights/evenings.

Work Location

New York, NY

Residency Requirement

New York City residency is generally required within 90 days of appointment. However, City Employees in certain titles who have worked for the City for 2 continuous years may also be eligible to reside in Nassau, Suffolk, Putnam, Westchester, Rockland, or Orange County. To determine if the residency requirement applies to you, please discuss with the agency representative at the time of interview.