Responsibilities
- Act as Cloud Security Subject Matter Expert (SME); develop and maintain cloud security standards, policies, procedures, and best-practice documentation defining Black Duck’s cloud security baseline.
- Design, build, and operate security controls for SaaS services running on AWS, GCP, and other cloud environments.
- Continuously monitor cloud resources and configurations to identify security risks; triage findings and drive remediation with resource owners.
- Identify threats through vulnerability assessments, penetration testing support, and log analysis; ensure security controls meet compliance requirements including SOC 2 and ISO 27001.
- Automate cloud security controls, data collection, and workflows using Python, Bash, cloud APIs, and infrastructure as code to improve operational efficiency and scale coverage.
- Operate and enhance the cloud security tooling ecosystem, including logging, monitoring, CSPM/CNAPP, vulnerability management, and detection platforms.
- Integrate security controls into CI/CD pipelines and engineering delivery workflows, advancing DevSecOps practices across the organization.
- Lead containment, forensic analysis, and remediation for cloud security incidents in partnership with CSIRT and engineering teams.
- Lead cloud security projects and major components of complex, cross-functional initiatives; influence cloud security architecture and strategy decisions across engineering, platform, and IT organizations.
- Design and improve cloud security processes and operational procedures to systematically reduce risk and increase organizational efficiency.
- Communicate cloud security risks, findings, and recommendations to Director- and VP-level stakeholders.
- Serve as a technical leader and coach for less experienced engineers; lead and participate in security reviews, threat modeling sessions, and architecture discussions.
- Negotiate and build consensus across engineering, platform, IT, and vendor partners; explain difficult or sensitive security information clearly to technical and non-technical audiences, including executives.
- Other tasks and activities as assigned.
Tech Stack
AWS, GCP, Azure, Kubernetes, Terraform, CloudFormation, Helm, Python, Bash
