EAS Level 2 Engineer (1)

Job Description

EAS Level 2 Engineer, Classic Managed File Transfer (MFT)

Position Summary

The EAS Level 2 Engineer, Classic Managed File Transfer (MFT) is responsible for engineering, remediation, operational support, and modernization activities across TransUnion's Classic MFT environment.

The immediate focus of this role will be supporting the technical changes required to improve PCI DSS 4.0 compliance across the legacy MFT ecosystem while maintaining the stability and availability of existing customer and internal file-transfer services.

The engineer will work across Classic MFT technologies and associated infrastructure to remediate security and compliance gaps involving encryption, authentication, cryptographic controls, secrets/key management, file scanning, infrastructure configuration, and secure file-processing workflows.

Primary Responsibilities

PCI DSS 4.0 Remediation

• Engineer and implement changes required to remediate identified PCI DSS 4.0 gaps within the Classic MFT environment.
• Support implementation of stronger protection for cardholder data throughout the file-transfer lifecycle, including files persisted to application-specific storage.
• Implement and validate encryption controls for applicable files and data flows.
• Assist with implementing appropriate authentication controls for interactive SFTP access, including MFA where required.
• Improve management of SSH keys, PGP/GPG keys, service credentials, passwords, and other secrets through approved enterprise vaulting solutions.
• Remediate weak or obsolete cryptographic protocols and cipher configurations.
• Support the IBM Sterling upgrade and associated security configuration work.
• Implement or integrate approved file/malware scanning capabilities.
• Work with PCI, Security and Architecture teams to validate that implemented controls meet defined compliance requirements.

Encryption and Key Management

The engineer will have a significant hands-on role in improving encryption and key-management practices.

Responsibilities should include

• Implementing and troubleshooting PGP/GPG-based encryption and decryption workflows.
• Supporting secure management and rotation of private/public keys.
• Moving applicable credentials and private keys toward approved vault-based storage.
• Supporting automation for retrieval and use of secrets without exposing sensitive credentials.
• Troubleshooting encryption issues across MFT, NAS/storage, application handoffs, and batch-processing workflows.
• Supporting file-level or equivalent approved encryption solutions for PCI-scoped data.
• Validating that files remain appropriately protected as they move between MFT and downstream processing environments.

MFT Modernization and Migration

• Analyze existing Classic MFT flows and document dependencies
• Identify legacy integrations that create security, operational, or compliance risk and recommend remediation or migration.

Required or strongly preferred

• Managed File Transfer engineering and production support experience
• SFTP / SSH
• IBM Sterling or comparable enterprise MFT technology
• PGP/GPG encryption and key management
• TLS, certificates, cryptographic protocols and cipher configuration
• Linux/Unix administration and troubleshooting
• File system and storage concepts
• Authentication and access-control concepts
• Secrets and credential management / enterprise vault technologies
• Production incident troubleshooting
• Change and release management
• Shell scripting and/or automation
• Network troubleshooting involving DNS, firewall rules, ports, routing and secure connections
• Experience supporting high-volume or business-critical file-transfer environments

Highly desirable

• PCI DSS 4.0 experience
• Experience engineering systems handling cardholder data
• MFA integration experience
• IBM Sterling upgrade/configuration experience
• Malware/file-scanning integration experience
• Experience with hybrid on-premises/cloud environments
• Experience migrating legacy MFT integrations to modern platforms
• Knowledge of encryption-at-rest and encryption-in-transit architectures

The successful candidate should be able to

• Independently troubleshoot complex MFT incidents.
• Analyze logs and determine the failure point across multi-system file-transfer workflows.
• Implement configuration and security changes under established change controls.
• Perform technical root-cause analysis.
• Work directly with application, infrastructure, network and security engineers.
• Execute documented implementation plans and contribute to solution design.
• Test technical changes and document results.
• Escalate product defects or complex engineering issues to Level 3/vendor teams with complete technical evidence.
• Translate PCI/security requirements into executable MFT engineering tasks.

Key Deliverables

During the initial PCI remediation effort, success in this role would include delivery against the major workstreams already identified internally:

• Encryption at rest

Implement or support the approved solution ensuring relevant cardholder-data files remain protected throughout the Classic MFT processing lifecycle.

• SFTP authentication / MFA

Implement the approved authentication model for applicable human SFTP access.

• Vault and secrets management

Move applicable SSH keys, PGP/GPG keys and credentials toward approved vault-based management.

• IBM Sterling / cryptography remediation

Support completion of the Sterling upgrade and remediation of identified weak cipher/protocol configurations.

• Malware/file scanning

Implement or integrate the scanning approach approved by Security/PCI.

• Compliance evidence

Document configurations, testing, validation and implementation evidence required to demonstrate the controls are operating as designed.