Typical Day in Role:
• Write Rego Policy-as-Code for application security scanning tools – SAST, DAST, SCA and MAST; to ensure that no critical or high vulnerabilities are deployed to production
• Write Rego Policy-as-Code for scanning Terraform and Cloud resources
• Write unit tests for these policies, and complete other QA activities to ensure the working and quality of the policies
• Deploy security policies to the cloud using DevOps strategies and tools.
• Integrate policies with Styra policy engine
• Work with cloud security architecture and cloud operations internal teams
• Role is split into technical part of 1) writing the Policy-as-Code, QA activities and 2) support delivery of the product – give updates, collaborate with team
Candidate Requirements/Must Have Skills:
1) 10+ years’ experience in related fields: Security Engineering, Cloud architecture, Security Operations, DevOps
2) 3-5 years’ experience with IaC (Infrastructure As Code) tool Terraform
3) 1-2 years’ experience with PaC (Policy As Code) tools Styra, Rego
4) 3-5 years’ experience with DevOps tools and strategies, including VCS, IaC, and automated pipelines
5) 3-5 years’ hands-on experience with Cloud platforms (Google Cloud, Azure, AWS – in order of preference)
Nice-To-Have Skills:
1) Experience with programming languages (Python, GO, Rego)
2) CI/CD tools experience
3) CNAPP experience
4) Experience from software delivery industry
5) Agile experience
Soft Skills Required:
• Able to maintain updated and consistent documentation about workflows, test results, change tickets and PoC implementations that are relevant for the team to reference.
• Able to prepare status updates and socialize them with team members and stakeholders.
• Collaboration skills to work with stakeholders like Platform Engineering and Security Architecture to align on the policies deployments.
• Proactively propose best practices to implement in our development and delivery lifecycles.
Education:
Bachelor’s in technical field e.g. computer science, information security
Cloud certifications and cloud security certifications are an asset