DevSecOps Engineer - Cloud Security CI/CD (Remote/Telecommute)
Oracle
2021-09-30T16:07:44Z
Orlando
Florida
United States
Information Technology
(No Timezone Provided)
The Senior Security Engineer is part of the Advanced Customer Services (ACS) Security and Risk Management team, responsible for security architecture, engineering, and automation for the services provided by the ACS Organization for ACS, Managed Cloud Services (MCS) and Managed Security Services (MSS) customers. Within the ACS Security and Risk Management team, you will join a diverse organization responsible for keeping Oracle’s Federal, Commercial, and other regulated environments’ data secure. As a member of this world-class team, you’ll design and implement security solutions to improve efficiency, performance, and reliability with an eye to automation and continuous integration, continuous delivery, and continuous deployment (CI/CD), as well as play a key role in the management of security risks in the solutions and services provided by our broader group, Advanced Customer Services.
We are looking for an engineer with a focus on both Information Security and DevOps/Site Reliability who will partner across departments to drive a DevSecOps approach, vulnerability remediation, and ensure compliance through our cloud and on-prem environments. Additionally, you will promote improvements in configuration management, provisioning, software deployment, vulnerability identification, and security compliance.
DevSecOps is the practice that automates, monitors, and applies security at all phases of the SDLC, and we want you to be part of it at Oracle.
This role requires US Citizenship and willingness to obtain a US Security Clearance in the future.
Key responsibilities include:
Design and implement security automation to improve efficiency, performance, and reliability. Promote improvements in configuration management, provisioning, software deployment, vulnerability identification, and security compliance. Investigate purported intrusions and breaches and oversee root cause analysis. Bring advanced-level skills to research, evaluate, track, and manage information security threats and vulnerabilities in situations where in-depth analysis of ambiguous information is required and/or where scripting is required (e.g. Ruby, Python, shell, terraform, etc). Work with senior management to develop and implement a multi-year security roadmap in accordance with DevSecOps philosophy. Contribute to the drive towards DevOps methodology with development and maintenance of CI/CD pipelines, automation, and API integrations. What we like to see
Established IT experience in a security-related role supporting complex architecture Broad technical background in infrastructure and Cloud applications with the acumen to interpret technical specs and architect solutions Proven experience engineering Cloud solutions in an Infosec, Developer, Site Reliability, or related DevOps role Experience implementing DevOps technologies and principles, especially CI/CD (e.g. Chef, Artifactory, Ansible) Familiarity with scripting and programming languages such as Ruby, Python, Terraform, and shell scripting. Strong knowledge of *nix and Windows system administration, cloud architecture and security principles, and Risk management frameworks Experience with commercial security products and closing the gaps through development, automation, API integrations, and researching and closing vulnerabilities via patching. US Citizenship Secret security clearance, or willingness/ability to obtain one if necessary. What we love to see
Experience with IT security across multiple hardware platforms, operating systems, and applications. Experience with EDR (Endpoint Detection & Response), Vulnerability Management and Micro-Segmentation tools. Knowledge of database security principles Knowledge of encryption technologies and architectures Experience with myriad DevOps tools such as Chef, Jenkins, Ant, Maven, Ansible, Puppet, CircleCI, and Bamboo Exposure to security standards such as FedRAMP, NIST 800-53, or PCI DSS and security controls like ISO 27001, SOC 2, and HITRUST as applied to cloud SaaS, PaaS, and IaaS operations Security Certifications such as CISSP, Security+, CCSP, GCIH, CISA, or CISM Excellent written and verbal communication skills Ability to adjust and adapt to changing priorities in a dynamic environment BS in related field from accredited university, or equivalent HR description: Responsible for the planning, design and build of security architectures; oversees the implementation of network and computer security and ensures compliance with corporate security policies and procedures.
Responsible for advanced planning, design and build of security systems, applications, environments and architectures; oversees the implementation of security systems, applications, environments and architectures and ensures compliance with information security standards and corporate security policies and procedures.
Provides technical advice and direction to support the design and development of secure architectures.
May participate in an incident management team, bringing advanced-level skills to respond to security events in line with Oracle incident response playbooks. Investigates purported intrusions and breaches, and oversees root cause analysis. Coordinates incidents with other business units and may act as Incident Commander of serious incidents. Develops new methods, and playbooks, as well as sophisticated scripts, applications, and tools, and trains others in their use.
May participate in an incident management team, responding to security events in line with Oracle incident response playbooks. Investigates purported intrusions and breaches, and oversees root cause analysis. Coordinates incidents with other business units and may act as incident commander of serious incidents. Participates in developing new methods, playbooks throughout Oracle.
Evaluates existing and proposed technical architectures for security risk, provides technical advice to support the design and development of secure architectures and recommends security controls to mitigate those risks. Evaluations of internal security architecture may include design assessment, risk assessment, and threat modeling.
Brings advanced-level skills to research, evaluate, track, and manage information security threats and vulnerabilities in situations where in-depth analysis of ambiguous information is required, and where computer programming/scripting knowledge is required.
Work with Senior management to develop and implement a multi-year security roadmap
Focus on operational and strategic level tasks, and provide counsel and guidance to the junior level security operations engineers in the department.
Minimum of 8 years related experience in an information security role supporting security programs and security engineering/architecture in complex enterprise environments. Hands on experience with enterprise security architecture, engineering and implementation required.
Knowledge of compliance program security controls, like ISO 27001, SOC 2, HITRUST, and FedRAMP, as applied to cloud SaaS, PaaS and IaaS operations.
Familiarity with SDLC principles and scripting & programming languages (such as Terraform, Python, and Ruby).
Strong knowledge of: Cloud architecture and security principles. Risk Management Frameworks. *nix and Windows system administration.
Experience with: Logging and log analysis. Identity management principles and technology.
Preferred but not required qualifications include:
Bachelor-level university degree in a relevant field from an accredited university, or equivalent.
Strong knowledge of web technologies, middleware, database, OS, firewalls, network communication protocols and methods.
Knowledge of database security principles.
Knowledge of encryption technologies and architectures.
Expert level experience in evaluating and assessing security threats across a variety of environments and industries.
Expert level understanding of secure networking principles, routers, switches and load balancers.
Range and benefit information provided in this posting are Colorado-specific. Colorado Pay Range: from $102,000 to $209,000 per annum eligible for bonus and equity.
Oracle maintains broad salary ranges for its roles in order to account for variations in knowledge, skills, experience and market conditions, as well as reflect Oracle’s differing products, industries and lines of business. Candidates are typically placed into the range based on the preceding factors as well as internal peer equity.
DevSecOps Engineer - Cloud Security CI/CD (Remote/Telecommute)
The Senior Security Engineer is part of the Advanced Customer Services (ACS) Security and Risk Management team, responsible for security architecture, engineering, and automation for the services provided by the ACS Organization for ACS, Managed Cloud Services (MCS) and Managed Security Services (MSS) customers. Within the ACS Security and Risk Management team, you will join a diverse organization responsible for keeping Oracle’s Federal, Commercial, and other regulated environments’ data secure. As a member of this world-class team, you’ll design and implement security solutions to improve efficiency, performance, and reliability with an eye to automation and continuous integration, continuous delivery, and continuous deployment (CI/CD), as well as play a key role in the management of security risks in the solutions and services provided by our broader group, Advanced Customer Services.
We are looking for an engineer with a focus on both Information Security and DevOps/Site Reliability who will partner across departments to drive a DevSecOps approach, vulnerability remediation, and ensure compliance through our cloud and on-prem environments. Additionally, you will promote improvements in configuration management, provisioning, software deployment, vulnerability identification, and security compliance.
DevSecOps is the practice that automates, monitors, and applies security at all phases of the SDLC, and we want you to be part of it at Oracle.
This role requires US Citizenship and willingness to obtain a US Security Clearance in the future.
Key responsibilities include:
Design and implement security automation to improve efficiency, performance, and reliability. Promote improvements in configuration management, provisioning, software deployment, vulnerability identification, and security compliance. Investigate purported intrusions and breaches and oversee root cause analysis. Bring advanced-level skills to research, evaluate, track, and manage information security threats and vulnerabilities in situations where in-depth analysis of ambiguous information is required and/or where scripting is required (e.g. Ruby, Python, shell, terraform, etc). Work with senior management to develop and implement a multi-year security roadmap in accordance with DevSecOps philosophy. Contribute to the drive towards DevOps methodology with development and maintenance of CI/CD pipelines, automation, and API integrations. What we like to see
Established IT experience in a security-related role supporting complex architecture Broad technical background in infrastructure and Cloud applications with the acumen to interpret technical specs and architect solutions Proven experience engineering Cloud solutions in an Infosec, Developer, Site Reliability, or related DevOps role Experience implementing DevOps technologies and principles, especially CI/CD (e.g. Chef, Artifactory, Ansible) Familiarity with scripting and programming languages such as Ruby, Python, Terraform, and shell scripting. Strong knowledge of *nix and Windows system administration, cloud architecture and security principles, and Risk management frameworks Experience with commercial security products and closing the gaps through development, automation, API integrations, and researching and closing vulnerabilities via patching. US Citizenship Secret security clearance, or willingness/ability to obtain one if necessary. What we love to see
Experience with IT security across multiple hardware platforms, operating systems, and applications. Experience with EDR (Endpoint Detection & Response), Vulnerability Management and Micro-Segmentation tools. Knowledge of database security principles Knowledge of encryption technologies and architectures Experience with myriad DevOps tools such as Chef, Jenkins, Ant, Maven, Ansible, Puppet, CircleCI, and Bamboo Exposure to security standards such as FedRAMP, NIST 800-53, or PCI DSS and security controls like ISO 27001, SOC 2, and HITRUST as applied to cloud SaaS, PaaS, and IaaS operations Security Certifications such as CISSP, Security+, CCSP, GCIH, CISA, or CISM Excellent written and verbal communication skills Ability to adjust and adapt to changing priorities in a dynamic environment BS in related field from accredited university, or equivalent HR description: Responsible for the planning, design and build of security architectures; oversees the implementation of network and computer security and ensures compliance with corporate security policies and procedures.
Responsible for advanced planning, design and build of security systems, applications, environments and architectures; oversees the implementation of security systems, applications, environments and architectures and ensures compliance with information security standards and corporate security policies and procedures.
Provides technical advice and direction to support the design and development of secure architectures.
May participate in an incident management team, bringing advanced-level skills to respond to security events in line with Oracle incident response playbooks. Investigates purported intrusions and breaches, and oversees root cause analysis. Coordinates incidents with other business units and may act as Incident Commander of serious incidents. Develops new methods, and playbooks, as well as sophisticated scripts, applications, and tools, and trains others in their use.
May participate in an incident management team, responding to security events in line with Oracle incident response playbooks. Investigates purported intrusions and breaches, and oversees root cause analysis. Coordinates incidents with other business units and may act as incident commander of serious incidents. Participates in developing new methods, playbooks throughout Oracle.
Evaluates existing and proposed technical architectures for security risk, provides technical advice to support the design and development of secure architectures and recommends security controls to mitigate those risks. Evaluations of internal security architecture may include design assessment, risk assessment, and threat modeling.
Brings advanced-level skills to research, evaluate, track, and manage information security threats and vulnerabilities in situations where in-depth analysis of ambiguous information is required, and where computer programming/scripting knowledge is required.
Work with Senior management to develop and implement a multi-year security roadmap
Focus on operational and strategic level tasks, and provide counsel and guidance to the junior level security operations engineers in the department.
Minimum of 8 years related experience in an information security role supporting security programs and security engineering/architecture in complex enterprise environments. Hands on experience with enterprise security architecture, engineering and implementation required.
Knowledge of compliance program security controls, like ISO 27001, SOC 2, HITRUST, and FedRAMP, as applied to cloud SaaS, PaaS and IaaS operations.
Familiarity with SDLC principles and scripting & programming languages (such as Terraform, Python, and Ruby).
Strong knowledge of: Cloud architecture and security principles. Risk Management Frameworks. *nix and Windows system administration.
Experience with: Logging and log analysis. Identity management principles and technology.
Preferred but not required qualifications include:
Bachelor-level university degree in a relevant field from an accredited university, or equivalent.
Strong knowledge of web technologies, middleware, database, OS, firewalls, network communication protocols and methods.
Knowledge of database security principles.
Knowledge of encryption technologies and architectures.
Expert level experience in evaluating and assessing security threats across a variety of environments and industries.
Expert level understanding of secure networking principles, routers, switches and load balancers.
Range and benefit information provided in this posting are Colorado-specific. Colorado Pay Range: from $102,000 to $209,000 per annum eligible for bonus and equity.
Oracle maintains broad salary ranges for its roles in order to account for variations in knowledge, skills, experience and market conditions, as well as reflect Oracle’s differing products, industries and lines of business. Candidates are typically placed into the range based on the preceding factors as well as internal peer equity.