Job DescriptionJob SummaryAs a member of the Information Security team, the Cloud Security Senior Engineer will be responsible for developing, implementing, and operating cloud security solutions and controls to address the current and emerging security and compliance needs of the business. The engineer will serve as a cloud security expert, integrating sound practices from Identity and Access management, monitoring, platform standards, network segmentation and interconnection, encryption, and more into the CHS cloud platforms. The engineer will contribute to technology decisions to reflect approved security architectures, business impact and exposures, emerging threats, vulnerabilities, regulatory requirements, and risks. The engineer will work with Enterprise Architects, other functional area architects, and security specialists to ensure adequate security solutions are in place throughout cloud IT systems and platforms, and will communicate the risks and solutions to business and IT partners.
Essential Functions- Define and document security standards for Cloud platforms, and follow them from initial idea to completion and governance. Collaborate with internal IT teams for implementing secure policies and settings within Cloud platforms, such as Infrastructure-as-a-service (IAAs), Software as-a-service (SAAS), and Platform as-a-service (PAAS). Coordinate the implementation of security standards for common Commercial off-the-shelf (COTS) applications and services within Cloud, including assisting with log aggregation and SSO/SAML integrations.
- Implement least privilege access policies and restrictions within common Cloud infrastructure platforms (Azure, AWS, Google Cloud Platform, Oracle)
- Contribute to and maintain security standards based on National Institute of Standards and Technology (NIST) recommendations, specifically NIST 800-53
- Provide security review for reference architectures provided by Information Technology architecture and internal security architecture teams. Provide Engineering review for Security Risk Assessments associated with Cloud platforms.
- Implement new toolsets related to cloud security, as well as automation and continuous development of cloud security processes, both operational and technical. Partner with architects to develop and implement enterprise information security cloud architectures and solutions.
- Develop documentation for all facets of Cloud configurations including: identity and access management, network segmentation, application security, data protection, encryption, and others.
- Support security teams with implementation of incident management and red team processes, privileged access management strategy, and vulnerability remediation
- Participate in DevSecOps processes and applications for automation including: Github, DAST/SAST tools, Code review processes
- Business and Soft Skill expectations:
- Communicate and interact effectively and professionally with co-workers, management, customers, etc.
- Maintain complete confidentiality of company business.
- Communicate with management regarding development within areas of assigned responsibilities and perform special projects as required or requested.
Qualifications- Bachelor's Degree in Cyber Security, Computer Science, Information Technology, or a related field; or the equivalent required
- 5-7 years of experience in cybersecurity, information technology operations, or a related field required
- 1 year of cloud technology
Knowledge, Skills and Abilities- Designed and implemented technologies within cloud platforms.
- Served as expert thought leader for cloud technology and influenced the strategy to address internal or external business and regulatory issues.
- Worked in process-driven structured environments, and participated in process optimization activities.
- Advanced knowledge of security principles, issues, techniques and implementations across cloud platforms.
- Proactive identification and solving of complex problems
- Strong understanding of systems development lifecycle to provide technical leadership for multifunctional projects or initiatives.
- Effective communication of technical concepts to a non-technical audience.
- Excellent written and verbal communication skills
Licenses and Certifications- Relevant security certifications (e.g., CISSP, GIAC, or OSCP) preferred
