Cloud Security Operations and Compliance Engineer

ROSALIND is a company dedicated to empowering scientists globally through genomic data interpretation. They are seeking a Cloud Security Operations and Compliance Engineer to ensure compliance with security and privacy regulations for their FedRAMP SaaS operations, while continuously assessing and improving security posture.

Responsibilities:

• Maintaining compliance with security and privacy regulations for our FedRAMP SaaS operations
• Apply your skills and knowledge to make sure the U.S. Federal SaaS environments are secured in accordance with cloud security best practices
• Operate with security in mind, and compliant with Rosalind internal requirements, as well as external regulations
• Continuously assess and improve security posture
• Implement effective security monitoring systems
• Collaborate on security controls reporting automation
• Ensure that active security monitoring of both commercial and U.S. Federal environments is undertaken on a continuous basis by overseeing a vulnerability management program
• Participate in and lead risk analysis of findings
• Ensure that the SecOps team is performing at maximum efficiency globally

Requirements:

• 5+ years of experience in the cybersecurity; with at least 2 years in a cloud security role
• Strong knowledge of Qualys, Linux, Docker, Wazuh
• Experience with vulnerability management and incident response processes
• History of implementing enterprise security tools - SIEM, IDS/IPS, FIM, PAM
• Knowledge of authentication protocols, authorization standards and crypto primitives (TLS, OAuth, SAML, JWT, etc)
• Familiarity with OWASP TOP-10, CIS Benchmarks, STIGs
• Experience / knowledge eMASS, SNAPS, PPSM, C-ITP
• Experience with Infrastructure as Code and Configuration Management tools
• Experience / knowledge of working with RESTFUL APIs and Webservices
• Experience with alerting and monitoring tools
• Experience with common security scanning tools (e.g. Nessus, Qualys, IBM AppScan, Burp Suite, etc.)
• Understanding of software development lifecycle models
• Ability to work effectively in a cross-functional setting through influence, persuasion, and collaboration
• Excellent problem solving, critical thinking, communication, and teamwork skills
• The security mentality that can analyze situations, technology, and human systems both as an attacker and defender
• Ability to understand the business' strategic goals and proactively pursue projects to advance them
• Clear experience with GCP services: Compute Engine, Cloud Armor, ISA, Cloud Storage
• Hands-on Experience with FedRAMP
• Knowledge of Python, Terraform is a plus
• Certification (GCP Security Specialty GCIH - GIAC Certified Incident Handler, (ISC)2 CCSP – Certified Cloud Security Professional) is a plus