Cloud Security Operations and Compliance Engineer

ROSALIND is a genomics data analysis platform company serving research, clinical, diagnostic, pharmaceutical, and biotech organizations. The Cloud Security Operations and Compliance Engineer will secure and operate commercial and U.S. Federal SaaS environments, maintain compliance with security and privacy regulations, continuously improve security posture, and oversee monitoring, vulnerability management, risk analysis, and security controls reporting automation.

Responsibilities:

• As a part of the Rosalind SecOps team, you will apply your skills and knowledge to make sure the U.S. Federal SaaS environments are secured in accordance with cloud security best practices, operated with security in mind, and compliant with Rosalind internal requirements, as well as external regulations
• You will continuously assess and improve security posture, implement effective security monitoring systems, collaborate on security controls reporting automation
• You will have direct responsibilities to ensure that active security monitoring of both commercial and U.S. Federal environments is undertaken on a continuous basis by overseeing a vulnerability management program, participating in and leading risk analysis of findings, and ensuring that the SecOps team is performing at maximum efficiency globally

Requirements:

• Have prior experience protecting cloud-based environments
• Have clear experience with GCP services: Compute Engine, Cloud Armor, ISA, Cloud Storage
• Hands-on Experience with FedRAMP
• 5+ years of experience in the cybersecurity; with at least 2 years in a cloud security role
• Strong knowledge of Qualys, Linux, Docker, Wazuh
• Experience with vulnerability management and incident response processes
• History of implementing enterprise security tools - SIEM, IDS/IPS, FIM, PAM
• Knowledge of authentication protocols, authorization standards and crypto primitives (TLS, OAuth, SAML, JWT, etc)
• Familiarity with OWASP TOP-10, CIS Benchmarks, STIGs
• Experience / knowledge eMASS, SNAPS, PPSM, C-ITP
• Experience with Infrastructure as Code and Configuration Management tools
• Experience / knowledge of working with RESTFUL APIs and Webservices
• Experience with alerting and monitoring tools
• Experience with common security scanning tools (e.g. Nessus, Qualys, IBM AppScan, Burp Suite, etc.)
• Understanding of software development lifecycle models
• Ability to work effectively in a cross-functional setting through influence, persuasion, and collaboration
• Excellent problem solving, critical thinking, communication, and teamwork skills
• The security mentality that can analyze situations, technology, and human systems both as an attacker and defender
• Ability to understand the business' strategic goals and proactively pursue projects to advance them
• Knowledge of Python, Terraform is a plus
• Certification (GCP Security Specialty GCIH - GIAC Certified Incident Handler, (ISC)2 CCSP – Certified Cloud Security Professional) is a plus