Security engineer in digital commerce

OneView is looking for a Senior Security Engineer to join our DevSecOps team and own the growth and ongoing management of our InfoSec program, covering cloud-hosted applications and infrastructure, security culture, and customer security requirements.

• Set the requirements for automated threat detection, response, and remediation in our cloud-hosted environments, choose the tooling with our platform engineers, and own the detection rules and response procedures it runs.
• Lead internal threat assessments of our environments.
• Assess our environments and security program against industry frameworks such as the CIS Benchmarks and the NIST Cybersecurity Framework.
• Review our external attack surface, including what public sources reveal about OneView.
• Design remediation plans and policies for security vulnerabilities. Write each fix as a backlog item with acceptance criteria and the evidence that will show it is complete, and give the team's technical product owner the risk assessment needed to rank it.
• Set the application security testing standards for development teams, including the automated security tests that run in our pipelines and the results a change must meet before release, and review findings with the engineers who fix them.
• Implement security controls in Terraform when that work is assigned to you, and review infrastructure as code changes that affect security.
• Plan and run the independent security assessments our customers require, such as penetration tests and third-party security assessments, and those we commission ourselves. Agree the scope with the assessor, and with the customer where they require it, act as OneView's point of contact during the assessment, and track each finding to closure.
• Lead security incident response, and act as the first escalation point for security incidents.
• Own external security audits of OneView end to end. Define and compile the evidence each control needs, attend the sessions with the auditors, answer their questions, and decide which information is appropriate to provide.
• Represent our security posture to customers through security reviews, questionnaires, due diligence, and follow-up discussions with the customer's security team.
• Identify platform security investments before anyone requests them, build the case for what each one is worth, and take it through the team's technical product owner to the Sr. Director and the executives who fund the work. Once it is approved, specify the work and verify the result.
• Explain security issues to engineers who need to change something, delivery leads who need to plan around it, and executives who need to decide, at the depth each one needs.

• 7+ years in software or cloud security with a hands-on engineering background, with working experience in each of the following areas, using one or more of these or comparable tools:
• Cloud platforms: AWS, Google Cloud, Microsoft Azure
• Infrastructure as code: Terraform with Terragrunt, CloudFormation
• CI/CD: CircleCI, GitHub Actions, GitLab CI/CD
• Security testing (static analysis, software composition analysis, container scanning, and infrastructure as code scanning): Snyk, Semgrep, SonarQube, Checkmarx, Veracode, Trivy, Checkov
• Cloud security services: AWS Security Hub, Amazon GuardDuty, Google Security Command Center
• Detection and logging: Splunk, Elastic, Datadog, Microsoft Sentinel, Google Security Operations
• Has built or specified security gates in CI/CD pipelines that stop a change that fails a security requirement.
• Has hands-on experience with infrastructure as code guardrails, secrets and key management, and policy as code.
• Has prepared the evidence for an external security audit or certification, such as ISO 27001, PCI DSS, Cyber Essentials Plus, or SOC 2, and answered the auditors' questions in the audit sessions. Knows what to disclose, what to defer, and when to say "I do not know".
• Has scoped an independent security assessment, such as a penetration test, and tracked its findings to closure.
• Has led the response to a major security incident, including containment, stakeholder communication, and the post-incident review.
• Has answered a customer's security team directly, including the people whose job is to test the answers they are given.
• Can explain security to people who are not security specialists.
• Has identified a security investment that had not been requested, built the case for it, and got it funded or scheduled. Can describe the argument that worked and the one that did not.
• Будет плюсом: Has taken a new product through ISO 27001, PCI DSS, or Cyber Essentials Plus certification; Has worked under a formal data classification scheme set by a customer or a regulator, and knows what each tier requires in practice: data residency, access control, encryption, retention, and who is cleared to handle it. Public sector, defense, financial services, and healthcare regimes qualify; A security certification such as CISSP, CCSP, OSCP, AWS Certified Security Specialty, or Google Professional Cloud Security Engineer; Written security documentation, including evidence packs, control narratives, and security policy; Has incorporated AI into their security practice, for example triaging scan output and drafting control narratives; Understands how contractual and regulatory restrictions limit what data may be processed by AI tooling, and can explain the operational implications to a team that wants to use it; Has represented a supplier at a customer's security governance forum, change advisory board, or service review; Experience of a regulated or public sector engagement where the security posture had contractual or financial consequences; Has run a security awareness or culture initiative that changed how other teams behaved, and can say how they know it did; Active in the security community, through conferences, vulnerability disclosure, open source, or research

• We are a remote-first team with Viewers working across the globe, and we operate as a trusted provider of digital commerce systems for leading retailers.
• Our teams operate independently. We expect people to identify what should be done differently, and they have the support of their team and of leadership to make the change.