DevSecOps Engineer

About the position

The IBM Cloud Object Storage team is seeking an experienced Security Developer. As a Security developer, you will be part of a highly focused, self-managed team that designs, develops and tests secure solutions created for IBM Cloud Object Storage workloads. Responsible for all aspects of security and compliance activities. Provide feedback to architects regarding any issues that can cause any security and compliance gaps. Manage projects with various priority levels and timelines from start to finish. Demonstrate best practices in all aspects of administration. Leverage various security tools to secure the offerings and make sure offering is adhered to the best security and compliance principles. Continuously stay abreast of new security and compliance guidelines to ensure more secure offering. Must collaborate with other departments to resolve complex issues and be detail oriented. Ability to automate security and compliance solutions to repetitive problems/tasks.

Responsibilities

• Design, develop and test secure solutions for IBM Cloud Object Storage workloads.
• Manage all aspects of security and compliance activities.
• Provide feedback to architects regarding security and compliance gaps.
• Manage projects with various priority levels and timelines.
• Demonstrate best practices in administration.
• Leverage security tools to secure offerings.
• Stay updated on new security and compliance guidelines.
• Collaborate with other departments to resolve complex issues.
• Automate security and compliance solutions for repetitive tasks.

Requirements

• 3+ years of working experience with Security and Compliance activities.
• Programming skills in Python and Shell Scripting.
• In-depth knowledge of end-to-end Security and Compliance activities such as Threat Models and Security Privacy by Design.
• Knowledge of security scanning tools such as Nessus scanner, SonarQube, NMap.
• In-depth understanding of security concepts including identity management/authentication, authorization, firewall, auditing, secure communication, managing certificates, and password management.
• Strong English communication skills, both written and verbal.
• Expertise in cryptographic key management and its lifecycle, as well as security architecture.
• In-depth knowledge of Hardware Security Modules, PKCS #11 APIs, Trusted Execution Environments, and Quantum Safe Algorithms.

Nice-to-haves

• General understanding of private/public/hybrid cloud concepts.
• In-depth understanding of hardware servers and server components.
• General understanding of open source projects; experience with open source community contribution is a plus.