Sr. Cloud Security Engineer

Primary Function:

This individual will serve as a thought leader and security expert for Zoro and is responsible for evaluating, implementing, and managing security tools designed to identify, protect, detect, respond, and monitor the cloud infrastructure and SaaS applications Zoro utilizes. They will also assess, recommend, and develop security controls for existing systems and applications operating in our environment. As a Senior Cloud Security Engineer, it will also be their responsibility to help promote positive change and build a security-aware technology culture within the Cloud Operations and surrounding organizations.

Duties and Responsibilities: 

• Design highly available, scalable, and resilient security solutions leveraging both cloud-agnostic and cloud-native tools within GCP and AWS.
• Design and implement container security enhancements.
• Design, implement and monitor solutions for network and landing zone security, server and container image hardening, identity and access management (IAM), data security, patch management, application security, secrets management.
• Design and implement automated security processes and controls to increase operational effectiveness and reduce manual processes.
• Lead collaborative design of solutions to meet remediation requirements from audits, security reviews, vulnerability scans, external regulatory changes, PEN Tests, and PCI changes.
• Lead automation efforts to minimize manual work, ensure compliance goals, and support continuous delivery frameworks and tools.
• Own, lead and manage the security vulnerability management program and remediation process across systems and component owners.
• Assess and implement monitoring tools to support operational and security incident response processes.
• Strengthen the data security approach by improving the preventative, detective, and corrective solutions.
• Lead in selecting security vendors and tools and managing vendor relationships.
• Research, analyze and assess threats and risks.
• Interface with teams to provide high-quality and low-friction security operations services throughout the organization.
• Serve as the hands-on subject matter expert for security operations.
• Guide technical teams on architectural, procedural, and security best practices.
• Communicate security risks and mitigation plans to business partners.
• Create documentation for security tools and services.
• Provide feedback on new and existing security policies.
• Create and maintain security standards, guidelines, and procedures.
• Stay abreast of security industry standards, technology changes, trends, and best practices.
• Review and approve security infrastructure change requests. 
• Provide leadership, training, and mentoring to junior team members.

Qualifications:

• Education: 
  • Bachelor’s degree in Information Systems or related degree, or equivalent job experience.
  • Possess an ISACA and/or ISC2 certification, such as CISSP, CCSP, or CSX-P
• Experience:
  • 5+ years cloud infrastructure operations or information security risk compliance experience.
  • 5+ years of experience in security engineering and operations.
  • Extensive experience with GCP and/or AWS.
  • Experience with SIEM tools.
  • Web application security, browser security models, and application security vulnerabilities such as the OWASP Top Ten.
  • Direct working experience in designing and implementing solutions to enforce security frameworks, controls, and benchmarks such as NIST Cyber Security Framework, CIS CSC, CIS Top 20, and ISO 27001.
  • Strong understanding of network attacks, DDoS, phishing, email protocols/security/spam, encryption, authentication, logging and log analysis, IP and device reputation, and security rules and policies.
  • Excellent organizational, communication, and interpersonal skills.
  • Innovative problem solving, research, and analytical skills.
  • Highly motivated self-starter.
  • Strong sense of ownership and driven to manage tasks to completion.
• Preferred:
  • Certified Information Systems Security Professional (CISSP).
  • Google Professional Cloud Security Engineer.