Rapid 7 Senior Engineer

Application closing date: Wednesday, 20 March 2024 • 11:59pm, Canberra time (in Canberra)
Estimated start date: Wednesday, 01 May 2024
Location of work: VIC
Working arrangements: The work is to be performed at the offices of Services Australia in the respective city. Some remote working arrangements may be considered on a case to case basis.
Length of contract: Until 30 June 2025
Contract extensions: 2 x 12 months
Security clearance: Must have Negative Vetting Level 1
Rates: $130 - $160 per hour (inc. super)
Services Australia is seeking a Senior Rapid7 Engineer who will provide support to supplement the in-place workforce capacity to perform project and capability uplift activities to meet the required maturity level targets set by the Department. This includes experience in configuring and managing the Rapid7 Nexpose product, experience with InsightVM and Scan Assistant agents, installing scan engines for large (50,000+ device) segregated environments, building custom templates based on business requirements, scheduling scans and building reports.
Primary Technologies:

• Windows Server
• Windows Desktop
• Applications Packager
• Rapid 7
• Broadcom Data Centre Security Engineer.

Key Tasks/Duties/Requirements:

• Configuring and managing the Rapid7 Insight VM product.
• Deploy Rapid 7 Insight VM to windows and midrange servers.
• Deploy and configure authenticated scan and scan assistant agents.
• Installing scan engines for large, segregated environments.
• Building custom templates based on business requirements.
• Scheduling scans and building reports.
• Implementing Rapid 7 Insight VM to meet the ACSC Essential 8 mitigation strategies applicable to Patch Operating Systems and Patch Applications.
• Ensure Rapid 7 Insight VM meets all ISM controls applicable to Essential 8 Maturity Level 1.
• An automated method of asset discovery is used at least fortnightly to support the detection of assets for subsequent vulnerability scanning activities.
• A vulnerability scanner with an up-to-date vulnerability database is used for vulnerability scanning activities.
• A vulnerability scanner is used at least daily to identify missing patches or updates for vulnerabilities in operating systems of internet-facing services.
• A vulnerability scanner is used at least fortnightly to identify missing patches or updates for vulnerabilities in operating systems of workstations, servers and network devices.

Essential Criteria * Demonstrated in depth knowledge of Insight Vulnerability Management onpremise implementation.

• Demonstrate capability of implementing the IVM product to meet Essential 8 Maturity Level requirements.

Desriable Criteria * Demonstrated ability to improve design and advise and guide on optimised design considering all design capabilities (ie Scalability, performance etc).

• Demonstrated ability to improve IVM configurations and advice on end to end Vulnerability Management process and best practice guide.