Job Description

Roles & Responsibilities

FortiPAM — Privileged Access Management

▪ Deploy, configure, and administer FortiPAM for centralized management of privileged accounts, credentials, and sessions across on-premises, cloud, and hybrid environments.

▪ Onboard privileged and service accounts (Windows, Linux/Unix, network devices, databases, hypervisors) into vaulted credential stores with automated password rotation policies.

▪ Configure and manage secure remote access workflows (RDP, SSH, HTTPS, database consoles) via FortiPAM's session broker, including session recording, live session monitoring, and just-in-time (JIT) access provisioning.

▪ Implement approval workflows, checkout/check-in policies, and dual-control access for high-risk privileged operations.

▪ Integrate FortiPAM with Active Directory/Entra ID, LDAP, RADIUS, and SAML/SSO providers for identity federation and MFA enforcement on privileged sessions.

▪ Configure granular role-based access control (RBAC) and least-privilege policies aligned with job function and risk tier.

▪ Set up session recording storage and retention policies, and integrate recorded sessions with SIEM/SOC workflows for forensic review.

▪ Conduct periodic access reviews, orphaned and stale privileged account audits, and credential rotation compliance checks.

▪ Troubleshoot connectivity, authentication, and session-broker issues between FortiPAM and target endpoints or devices.

▪ Develop and maintain break-glass / emergency access procedures for FortiPAM outages.

FortiDLP — Data Loss Prevention

▪ Design, implement, and tune FortiDLP policies to detect and prevent unauthorized transfer of sensitive data (PII, PHI, financial data, intellectual property) across endpoints, email, web, and removable media channels.

▪ Build and maintain data classification schemas and fingerprinting/pattern-matching rules (regex, exact data match, document fingerprinting, OCR-based detection for scanned or image content).

▪ Configure endpoint DLP agents for monitoring and blocking of USB, cloud upload (SaaS/CASB integration), print, clipboard, and screen-capture activities.

▪ Integrate FortiDLP with FortiMail and web/proxy gateways to enforce consistent data-protection policy across all egress channels.

▪ Analyze DLP incident alerts, tune detection thresholds to reduce false positives, and produce incident investigation reports for compliance and legal review.

▪ Collaborate with data owners and compliance teams to define sensitivity labels and policy exceptions in line with regulatory requirements, including healthcare data protection standards.

▪ Maintain audit trails and generate DLP compliance reporting for internal audits and regulatory assessments.

▪ Perform periodic policy simulation and testing (tabletop and live data-exfiltration test scenarios) to validate DLP efficacy.

FortiMail — Email Security Gateway

▪ Administer FortiMail in gateway/transparent mode across a multi-tenant Microsoft 365 and hybrid Exchange environment.

▪ Configure and maintain SPF, DKIM, and DMARC records/policies across all managed domains; monitor DMARC aggregate and forensic reports for spoofing and delivery issues.

▪ Design and tune anti-spam, anti-phishing, anti-malware, impersonation analysis, and URL/attachment sandboxing policies.

▪ Configure and manage SMTP relay validation, connection security (TLS enforcement, opportunistic vs. forced TLS), and IP reputation/greylisting policies.

▪ Manage Protected Identities / executive impersonation protection features and business email compromise (BEC) detection rules.

▪ Integrate FortiMail with Microsoft Graph API for journaling, quarantine management, and mailbox-level remediation actions.

▪ Maintain multi-tenant domain onboarding, per-tenant policy segregation, and delegated administration structures.

▪ Conduct User Acceptance Testing (UAT) for FortiMail policy changes and upgrades, including test-execution documentation and vendor coordination.

• ▪ Monitor mail queues and bounce/NDR patterns, and troubleshoot mail-flow issues across hybrid Exchange/M365 routing.

Job Description

Roles & Responsibilities

FortiPAM — Privileged Access Management

▪ Deploy, configure, and administer FortiPAM for centralized management of privileged accounts, credentials, and sessions across on-premises, cloud, and hybrid environments.

▪ Onboard privileged and service accounts (Windows, Linux/Unix, network devices, databases, hypervisors) into vaulted credential stores with automated password rotation policies.

▪ Configure and manage secure remote access workflows (RDP, SSH, HTTPS, database consoles) via FortiPAM's session broker, including session recording, live session monitoring, and just-in-time (JIT) access provisioning.

▪ Implement approval workflows, checkout/check-in policies, and dual-control access for high-risk privileged operations.

▪ Integrate FortiPAM with Active Directory/Entra ID, LDAP, RADIUS, and SAML/SSO providers for identity federation and MFA enforcement on privileged sessions.

▪ Configure granular role-based access control (RBAC) and least-privilege policies aligned with job function and risk tier.

▪ Set up session recording storage and retention policies, and integrate recorded sessions with SIEM/SOC workflows for forensic review.

▪ Conduct periodic access reviews, orphaned and stale privileged account audits, and credential rotation compliance checks.

▪ Troubleshoot connectivity, authentication, and session-broker issues between FortiPAM and target endpoints or devices.

▪ Develop and maintain break-glass / emergency access procedures for FortiPAM outages.

FortiDLP — Data Loss Prevention

▪ Design, implement, and tune FortiDLP policies to detect and prevent unauthorized transfer of sensitive data (PII, PHI, financial data, intellectual property) across endpoints, email, web, and removable media channels.

▪ Build and maintain data classification schemas and fingerprinting/pattern-matching rules (regex, exact data match, document fingerprinting, OCR-based detection for scanned or image content).

▪ Configure endpoint DLP agents for monitoring and blocking of USB, cloud upload (SaaS/CASB integration), print, clipboard, and screen-capture activities.

▪ Integrate FortiDLP with FortiMail and web/proxy gateways to enforce consistent data-protection policy across all egress channels.

▪ Analyze DLP incident alerts, tune detection thresholds to reduce false positives, and produce incident investigation reports for compliance and legal review.

▪ Collaborate with data owners and compliance teams to define sensitivity labels and policy exceptions in line with regulatory requirements, including healthcare data protection standards.

▪ Maintain audit trails and generate DLP compliance reporting for internal audits and regulatory assessments.

▪ Perform periodic policy simulation and testing (tabletop and live data-exfiltration test scenarios) to validate DLP efficacy.

FortiMail — Email Security Gateway

▪ Administer FortiMail in gateway/transparent mode across a multi-tenant Microsoft 365 and hybrid Exchange environment.

▪ Configure and maintain SPF, DKIM, and DMARC records/policies across all managed domains; monitor DMARC aggregate and forensic reports for spoofing and delivery issues.

▪ Design and tune anti-spam, anti-phishing, anti-malware, impersonation analysis, and URL/attachment sandboxing policies.

▪ Configure and manage SMTP relay validation, connection security (TLS enforcement, opportunistic vs. forced TLS), and IP reputation/greylisting policies.

▪ Manage Protected Identities / executive impersonation protection features and business email compromise (BEC) detection rules.

▪ Integrate FortiMail with Microsoft Graph API for journaling, quarantine management, and mailbox-level remediation actions.

▪ Maintain multi-tenant domain onboarding, per-tenant policy segregation, and delegated administration structures.

▪ Conduct User Acceptance Testing (UAT) for FortiMail policy changes and upgrades, including test-execution documentation and vendor coordination.

• ▪ Monitor mail queues and bounce/NDR patterns, and troubleshoot mail-flow issues across hybrid Exchange/M365 routing.