The Sr. Security DevOps Engineer will work with Architecture and Infrastructure teams supporting multiple projects. You will be expected to deliver innovative ideas through automation to enable standard deployable units of monitoring applications across multiple environments. The Sr. Security DevOps Engineer will be taking part in developing solutions in the cloud.
* Architecting, designing and implementing automation for various functions, as well as continuously improving the security of our products, managing cloud security tools and driving security standardization
* Coach teams in the best security practises for DevOps.
* Prepare and document standard operating procedures and protocols
* Configure and troubleshoot security infrastructure devices
* Develop technical solutions and new security tools to help mitigate security vulnerabilities and automate repeatable tasks
* Ensure that the company knows as much as possible, as quickly as possible about security incidents
* Security Incidents - help incident response team with security incidents as needed.
* Write comprehensive reports including assessment-based findings, outcomes and propositions for further system security enhancement.
* On Call for Security Incidents as needed
Bachelor's degree in computer science, information systems and/or equivalent formal training or work experience. Five (5) years of experience in IT information security.
Current CISSP, CRISC, CISA, GIAC or equivalent certification preferred
AWS Certifications preferred
SANS-related certifications Education
* 5+ years of professional experience working as a Systems Engineer, DevOps Engineer or Cloud Infrastructure Architect with the ability to perform basic scripting
* 2+ years of experience in building and maintaining security systems
* 2+ years of experience in security systems, including firewalls, intrusion detection systems, anti-virus software, authentication systems, log management, content filtering, etc?
* 3+ years with Configuration Automation Tools such as: Ansible, Puppet, Chef and writing recipes
* Full end-to-end understanding of CI/CD pipeline and how to assess them from a security point of view
* Experience with both Static and Dynamic Application Security Testing methodologies and tools
* Experience with Implementing Analytics and Monitoring Tools, Splunk
* Experience in setting up AWS, Azure security groups, VPC
* Experience with Ruby on Rails, Source control, Git, Groovy, Python, PowerShell, JSON
* Familiar with Database systems
* Experience with vulnerability management and risk assessment
* Knowledge of cyber security standard frameworks such as ISO and NIST
* Excellent written and oral communication skills.
* Excellent customer service skills and problem resolution.
* Experience in being able to manage and prioritize multiple tasks in an effective manner.
* Ability to work independently without daily direction.
* Understanding of back-channels typically used by actors for malicious activity.
* Understanding of obfuscation techniques and best practices for ensuring device non-attribution.
* Understanding of one or more Technology Platforms (Windows, Linux, Middleware Applications, Database Applications) - specifically as they apply to successful security control mitigation and particularly to vulnerability management.
* Understanding of distributed denial of service attack intelligence gathering, concepts, mitigation tools, and techniques.
* Understanding of mobility security device and application risk and threat assessment.
* Understanding of nation and non-nation state actors, hacktivist groups, advanced threats, and the \"kill chain\" methodology.
* Familiarity with secure coding best practices.
* Strong communication & organizational skills, ability to multi-task, strong attention to details, excellent problem solving and follow-up skills required.