At Oshkosh, we build, serve and protect people and communities around the world by designing and manufacturing some of the toughest specialty trucks and access equipment. We employ over 18,000 team members all united by a common purpose. Our engineering and product innovation help keep soldiers and firefighters safe, is critical in building and keeping communities clean and helps people do their jobs every day.

JOB SUMMARY:

Oshkosh Corporation owns significant assets in the form of information. Some of these assets lose significant value if they are improperly disclosed. Similar disclosure of other assets could result in significant harm to the corporation. This job supports the enterprise-wide, global cybersecurity purpose: Trusted advisor – empowering team members to make risk-aware decisions; Strategic enabler – enhancing the value of Oshkosh delivers to our customers; Vigilant guardian – protecting Oshkosh’s people and critical digital assts.

ESSENTIAL DUTIES AND RESPONSIBILITIES:  

These duties are not meant to be all-inclusive and other duties may be assigned.

• Research, design, and advocate for new technologies, architectures, and security products that will mitigate our enterprise global cyber risks. Act as a technical liaison between customers, engineering and information technology teams and share best-practice knowledge.

• Serve as a security expert in network and/or application or platform design, endpoint protection, mobile devices, SDLC, loT security (operational & product technologies), SaaS, LaaS, PaaS, and foundational cybersecurity technical controls.

• Lead development and maintenance of business, cybersecurity, and technical artifacts that constitute the global cybersecurity architectural standards, and the alignment of cybersecurity governance with enterprise architecture governance & project / portfolio management.

• Work closely with other functional area architects/analysts, DevOps, and project teams to ensure adequate security solutions are in place throughout all IT systems to mitigate identified risks sufficiently, while meeting business objectives & regulatory requirements.

• Establish and conduct technology audits to include, but not be limited to, threat and vulnerability management, SDLC, incident response, cloud, and supplier risk management.

• Analyze business impacts and exposure, based on emerging security threats, vulnerabilities, and risks. Evaluate and develop secure solutions, based on security standards to mitigate cyber risk to appropriate levels.

• Contribute to the development and maintenance of the information security strategy.

• Communicate security risks and mitigation alternatives / recommendations to business partners, business, and IT staff.

MINIMUM QUALIFICATIONS:   

• Bachelor’s Degree in Cybersecurity, Computer Engineering or equivalent.

• Ten (10) or more years of cybersecurity or information security experience; three (3) or more of those years in DevOps and/or SDLC, computer networks experience.

• Relevant industry recognized certifications (GISP, GWAPT, GWEB, ISA/IEC 62443 Cybersecurity Certificate, CISSP, CCSP, CSSLP).

• Knowledge of various programming languages (Android/Java, C, Python, etc.)

                                                                                                                                        

PREFERRED QUALIFICATIONS: 

• Preferred: Master’s degree or Ph.D. in Cybersecurity, Computer Engineering, Computer Science or equivalent.

• Understanding of application, server, and network security and compliance requirements such as FedRAMP, DFARS, and NIST 800-171.

• Understanding of cryptographic hardware accelerators (Hardware Security Module, etc.).

• Understanding of cybersecurity algorithms (AES, ECC Curves, RSA, SHA, HMAC, CMAC, etc.).

• In-depth knowledge and experience with encryption including application specific network.

• Protocols, in-transit and at-rest encryption protocol implementation and validation, cipher suites.

• Hands-on experience with: SIEM/SOAR platforms (e.g., Splunk, IBM QRadar, Palo Alto XSOAR)

• Hands-on experience with: Identity and Access Management (IAM) tools (e.g., SailPoint, Azure Entra, Okta)

• Hands-on experience with Network tools and platforms (e.g., Cisco, Palo Alto Networks, SolarWinds)

BASIC COMPETENCIES:

• Internal Contacts: Contact with employees or others primarily at a routine level involving basic information exchange; Contact with peers and others involving explanation of information (these contacts may be within or outside department or division), and the gathering of factual information; may include the communication of sensitive or confidential information; Contact across departments or divisions with employees involving persuasion of others, absent formal authority, to conform to a policy interpretation or recommend course of action.

• External Contacts: External contact involving a requirement to maintain a continuing external working relationship with individuals, or organizations.

• Communication Skills: Read, write and comprehend simple instructions, short correspondence and memos; Read and interpret safety rules, operating/maintenance instructions and procedure manuals; Write routine reports, correspondence and speak effectively before both internal and external groups; Read, analyze and interpret business manuals, technical procedures and/or government regulations; Read, analyze and interpret scientific and technical journals, financial reports and legal documents.

• Decision-Making: Significant responsibility for decisions and final results, affecting more than one function or a function with multiple units. Substantial analysis is required and many factors must be weighed before a decision can be reached.

• Complexity, Judgment and Problem Solving: Work requires the ability to plan and perform work in light of new or constantly changing problems, work from broad instruction, and deal with complex factors not easily evaluated.  Decisions require considerable judgment, initiative and ingenuity in areas there is little precedent.

• Supervisory/Managerial: General instructing, scheduling, and reviewing the work of others performing the same or directly related work. Acts as “lead worker”. Job functional supervision only.

WORKING CONDITIONS:

• Physical Demands: Frequent Sitting, Hearing, Talking, Visual, Typing, and Manual Dexterity. Seldom Standing, Walking/Running, Reaching, Driving, Bending/Kneeling, Fine Dexterity, Upper Extremity Repetitive Motion, Lifting/Carrying 40lsb, Pushing/Pulling 40lbs.

• Non-Physical Demands: Frequent Analysis/Reasoning, Communication/Interpretation, Math/Mental Computation, Reading, Sustained Mental Activity (i.e. auditing, problem solving, grant writing, composing reports), Writing.

• Environmental Demands: Occasional Work Alone. Seldom Frequent Task Changes, Tedious/Exacting Work.

• Work Schedule: Routine shift hours. Infrequent overtime, weekend, or shift rotation.

• Demands/Deadlines: Occasional stress due to deadlines or workload because of intermittent or cyclical work pressures, or occasional exposure to distressed individuals within the immediate work environment.

Pay Range:

$151,400.00 - $272,600.00

Oshkosh is committed to working with and offering reasonable accommodation to job applicants with disabilities. If you need assistance or an accommodation due to disability for any part of the employment process, please contact us at [email protected].

Oshkosh Corporation is a merit-based Equal Opportunity Employer. Job opportunities are open for application to all qualified individuals and selection decisions are made without regard to race, color, religion, sex, national origin, age, disability, veteran status, or other protected characteristic. To the extent that information is provided or collected regarding categories as provided by law it will in no way affect the decision regarding an employment application.

Oshkosh Corporation will not discharge or in any manner discriminate against employees or applicants because they have inquired about, discussed, or disclosed their own pay or the pay of another employee or applicant. However, employees who have access to the compensation information of other employees or applicants as a part of their essential job functions cannot disclose the pay of other employees or applicants to individuals who do not otherwise have access to compensation information, unless the disclosure is (a) in response to a formal complaint or charge, (b) in furtherance of an investigation, proceeding, hearing, or action, including an investigation conducted by the employer, or (c) consistent with Oshkosh Corporation's legal duty to furnish information.

Certain positions with Oshkosh Corporation require access to controlled goods and technologies subject to the International Traffic in Arms Regulations or the Export Administration Regulations. Applicants for these positions may need to be "U.S. Persons," as defined in these regulations. Generally, a "U.S. Person" is a U.S. citizen, lawful permanent resident, or an individual who has been admitted as a refugee or granted asylum.