工作职责:
职位描述/Position Description：
负责信息安全技术安全防护体系建设运维；负责日常安全运营及控制检查；负责风险、漏洞和事件管理等工作，综合提升IT安全技术架构抗脆弱能力。
Responsible for the construction, operation and maintenance of information security technology security protection system; Responsible for daily safety operation and control inspection; Be responsible for risk, vulnerability and incident management, and comprehensively improve the anti-vulnerability capability of IT security technology architecture.
主要职责/Main Responsibilities：
1、负责IT安全技术防护体系的规划、建设、维护和优化；
Responsible for the planning, construction, maintenance and optimization of IT security technology protection system;
2、负责IT运营过程中的检查监督，开展漏洞扫描、日志审计、配置核查、源代码审计等；
Responsible for the inspection and supervision in the process of IT operation, carried out vulnerability scanning, log audit, configuration verification, source code audit, etc.;
3、负责安全加固，包括策略加固、漏洞加固、补丁测试等；
Responsible for security reinforcement, including strategy reinforcement, vulnerability reinforcement, patch testing, etc.;
4、定期组织收集、整理、分析公司的IT安全状况和业界IT安全的动态，提出IT安全的预警报告和落实防范措施；
Regularly organized the collection, sorting and analysis of the IT security situation of the company and the industry's IT security dynamics, put forward IT security early warning reports and implemented preventive measures;
5、负责IT安全事件的管理，包括应急响应计划制定、演练和处置；
Responsible for IT security incident management, including emergency response plan formulation, drill and disposal;
6、负责IT安全技术制度、流程和标准的建设和更新及技术文档的管理；
Responsible for the construction and update of IT security system, process and standard, and the management of technical documents;
7、负责IT安全技术类的培训、宣贯、测试等工作的计划和执行。
Responsible for the planning and implementation of IT security technology training, publicity and implementation, testing and other work.
任职资格:
任职要求/ Qualifications：
? 学士及以上，计算机应用、计算机网络、通信、信息安全等相关专业本科学历，985或211学校毕业为佳；
Bachelor degree or above, bachelor degree in computer application, computer network, communication, information security or other related majors, preferably graduated from 985 or 211 school;
? 3年以上计算机行业的从业经验，其中至少2年以上网络安全经验，有汽车产品或制造行业安全技术和安全服务经验为佳；
More than 3 years of working experience in computer industry, including at least 2 years of network security experience. Experience in security technology and security service in automobile products or manufacturing industry is preferred;
? 精通网络安全技术：包括端口、服务漏洞扫描、程序漏洞分析检测、权限管理、入侵和攻击分析追踪、网站渗透、病毒木马防范等。熟悉tcp/ip协议，熟悉sql注入原理和手工检测、熟悉内存缓冲区溢出原理和防范措施、熟悉信息存储和传输安全、熟悉数据包结构、熟悉ddos攻击类型和原理，有一定的ddos攻防经验，熟悉iis安全设置、熟悉ipsec、组策略等系统安全设置；熟悉windows或linux系统，精通php/shell/perl/python/c/c++ 等至少一种语言；了解主流网络安全产品的配置及使用（如fw、ids、scanner、audit等）；如具备车联网、工控相关技术基础，有攻防渗透经验，拥有CCIE安全方向/HCIE安全方向证书/CISP–PTE渗透测试工程师/CISP-PTS渗透测试专家等安全技术方面证书为佳；
Proficient in network security technologies: including port, service vulnerability scanning, program vulnerability analysis and detection, authority management, intrusion and attack analysis and tracking, website penetration, virus Trojan prevention, etc. Familiar with TCP/IP protocol, familiar with SQL injection principle and manual detection, familiar with memory buffer overflow principle and prevention measures, familiar with information storage and transmission security, familiar with packet structure, familiar with ddos attack type and principle, have certain experience in ddos attack and defense, familiar with iis security Settings, familiar with ipsec, group policy and other system security Settings; Be familiar with Windows or Linux system, proficient in PHP/shell/perl/python/c/c + + and so on at least one language; Understand the configuration and use of mainstream network security products (such as fw, ids, scanner, audit, etc.); It is better to have the CCIE safety direction /HCIE safety direction certificate /CISP -- PTE penetration test engineer/cisp-pts penetration test expert and other safety technology certificates.
? 具有较强的分析和学习能力；善于表达沟通，责任心强，具有良好的团队协作精神；具有基础的英语口语和读写能力。
Strong analytical and learning skills; Good at communication, strong sense of responsibility, good team spirit; Basic command of spoken and written English.