Senior Security Engineer

About the Team

We are the security engineering team at the bank dedicated to building and operating secure systems at a production scale. Our mission is to provide robust tools and processes that enable rapid innovation while maintaining strong security standards across the organization. We focus on embedding security controls and continuously improving security culture using precise security metrics.

Role Overview

We seek a Senior Security Engineer passionate about advancing information security by crafting tools that uncover and eliminate vulnerabilities throughout the entire software development lifecycle. Our responsibilities span multiple domains including cloud security, DevSecOps, privileged access management, container orchestration (Kubernetes), cryptography, SaaS security, and automated incident response.

As part of this role, you will take a lead role on a public cloud security program focusing on real-time identification of vulnerabilities and automating their remediation. You will work hands-on with public cloud environments, Terraform infrastructure as code, commercial cloud security posture management solutions, and open-source Kubernetes admission controllers such as Kyverno to automate and enhance our security posture.

Key Responsibilities

• Design and deploy advanced preventative and detective security controls.
• Integrate security earlier in the development lifecycle by implementing commercial security tools and scanners.
• Partner with security engineers and engineering squads to research and develop scalable solutions to detect security issues.
• Evaluate, extend, and contribute to open-source security tools integrating them into CI/CD pipelines.
• Constantly review and refine security processes to raise the overall security level continuously.
• Build tools for static application security testing (SAST) and dynamic application security testing (DAST).
• Develop automated security scanning solutions for cloud infrastructure as code, with preference given to experience in Sentinel policies for Terraform.

Qualifications and Experience

• Deep understanding of public cloud security principles and native cloud security services is advantageous.
• Knowledge of global and industry security frameworks such as CIS, NIST 800-53, and PCI-DSS.
• 5 to 7+ years of relevant experience in security engineering or a related field.
• Experience scripting or programming for security automation, with skills in languages like Go or Python to effectively integrate and automate processes.
• Familiarity with container technologies (AWS EKS, Docker, Kubernetes) and admission controllers like Kyverno is preferred.
• Strong interpersonal skills with capability to thrive under pressure, embracing creativity, open-mindedness, and innovation.