Job Description

Advanced experience in architecting infrastructure solutions including proven experience with infrastructure integration. 

During the initial evaluation of the Centrify product the following business objectives were given and agreed upon by DTMB and MCS as requirements for the purchase of the product.  We have attached and installed Centrify and connected Linux servers to Active Directory.  The following tasks are needed to be completed to satisfy the agreed upon Business Objectives. 

Resource Tasks:  

• Centrally Manage all user accounts to satisfy audit requirements. 

• Provide detailed auditing of all tasks executed on all NGDI servers. 

• Utilize RBAC to provide a higher level of security and maintain compliance with all the regulatory bodies. 

• Configure solution according to standards to ensure proper operations. 

• Provide the ability to have secure authentication without entering passwords with emphasis on the DMZ. 

• Limit attack vectors in the event that a breach may occur.

1. Task

Update all servers with the appropriate DNS settings and validate that both forward and reverse lookup entries are created in the NGDS Domain 

Issue  

This is to ensure proper operations.  Pointing the servers to the correct DNS servers and populating the reverse DNS ensures that industry standards are adhered to and that we limit potential outages 

2. Task

Configure Kerberos authentication on all Linux servers so that there is no password keyed in at the time of logon.  This will mitigate the passwords staying resident in memory where they can be retrieved by scraping the memory 

Issue 

Kerberos authentication – this was one of the requirements when we first were rolling out Centrify.  Kerberos authentication means that passwords are not entered into the endpoint which protects against password theft through memory scraping. 

3. Task

Configure Centrify Zone Provisioning agent.  This is the automated provisioning of users and groups into Centrify for granting permissions for accessing servers. 

Issue 

This automatically adds and removes users from the Centrify system.  This reduces potential human errors during deploy and the auto removal ensures security holes are closed when a user is removed 

4. Task

Install Centrify Agent on all windows servers in NGDI.  Configure and validate video 

Issue 

To reduce the chance of pivot attacks in windows we install Centrify on Windows and configure RBAC.  With domain accounts the likely hood of a pivot attack after a breach is quite high. 

5. Task

Remove user access from launching a console session through BladeLogic. 

Issue 

This is a breach in separation of duties.  Unfortunately, in its current configuration the administrators of BSA have the ability to grant themselves access to data.  Secondly the administrators are all connecting to the servers as root through the nsh that BladeLogic provides 

6. Task

Upgrade all Centrify components to the latest code. 

Issue 

This would be to gain the enhancements in the newer versions, bug fixes and to provide any security patches that come with the upgrade 

7. Task

Develop and Configure Roles in Centrify for granting appropriate access to servers based on job function. (DBA, Sysadmin, WebAdmin, WASAdmin….etc.) 

Issue 

Too many loose privileges leave countless back doors for potential attackers. The RBAC will tighten up privileges and reduce potential attack vectors 

8. Task

Fix Licensing server in Zone 1.49 

Issue 

There was a change in the licensing service with in Centrify.  There should only be one license server per forest.  Currently there are 2 in Zone 1.49 

Qualifications

• Unix System Administration Required 5 Years 
• Experience in creation, maintenance, and execution of system/administrative scripts such as Bash, Python, Power Shell Required 5 Years 
• Experience with creation of scripts in Ansible to automate software provisioning, configuration management and application deployment Required 2 Years 
• Experience working with and configuration of user identity management Required 5 Years 
• Experience in deploying and administering storage hardware or logical storage arrays Required 5 Years 
• Experience working in a Devops or Secops capacity in a 1000+ server environment Required 5 Years 
• Experience with working with CICD, containers, Docker, Kubernetes and/or OpenShift deployments and support Required 2 Years 
• Experience installing, configuring, and administering Red Hat Enterprise Linux Required 5 Years 
• Experience resolving intermediate issues with Configuration Management and Networking concepts Required 5 Years 
• Experience in performing security testing such vulnerability assessments or penetration tests to identify security misconfiguration or vulnerable SW Required 5 Years 
• Experience in remediating security issues identified by vulnerability assessments or penetration tests Required 5 Years 
• Ability to design, implement and operate systems with adherance to industry compliance such as PCI-DSS, HIPAA, ISO and identify policy violations or s Required 5 Years 
• There is no direct public transportation to this location. Candidate must have their own vehicle and pay for transportation costs. Must also have valid state ID, driver's license, or passport for badging. 
• Please confirm all aspects of the skills matrix (above) - are listed and accurate on the candidate's resume. If there are inconsistencies between the number of years listed and what shows on the resume - candidate may not be considered for position. 
• For any potential candidate in need of work authorization/verification, please be advised that by order of the SOM AG office – SOM managers will not/cannot sign any supplier letter(s) directly. If you require a template letter with engagement specifications for any potential H1 filing(s), please contact you’re the CAI Program Managers for an assignment letter with description, duration, and engagement specifics. CAI cannot request SOM letters nor will SOM provide letters directly. Please confirm. 
• Interviews to take place: the week of December 10th; please do not submit candidates who cannot facilitate these specific dates/times

Additional Information

For immediate consideration, please send your resume to hire(at)cci-worldwide.com with "Unix Centrify Architect(Job ID:576406)MI"  as the subject line.