Description

Company Overview:

Trellance is a leading provider of business analytics and technology consulting for credit unions, helping them meet the financial needs of today’s digital consumer. With a comprehensive suite of data science solutions, professional staffing and professional services, the Trellance team ensures credit unions increase efficiency, manage risk, and improve member experience. As credit unions’ tech partner, Trellance brings them to the next frontiers of fintech, filled with powerful tools such as artificial intelligence and machine learning.

Overall Responsibilities: 

Engineer, automate and maintain Cloud Systems Security Policies, Practices, Alerting, and to actively monitor Cloud Systems Security infrastructure across multiple cloud service providers, sites and/or business units. Accountable for supporting day-to-day business success by aligning cloud security services in a DevSecOps environment across multiple teams. Responsible for secure day-to-day PCI DSS (PCI), Service Organization Controls (SOC) and ISO 27001:2013 compliant operations. Develop tools and reports to regularly communicate Cloud Security posture and risks with management.

ESSENTIAL FUNCTIONS:

· Develop, implement, and automate Cloud Security governance and security policies.

· Providing remediation strategies, and implementing project activities to complete tactical objectives

· Play a key role in designing, deploying, and maintaining solutions, automate security assessments, audits, policy and standard enforcements, and more. 

· Participate and contribute as a leader in the Trellance DevSecOps communities.

· Participate in architecting, building, and maintaining secure cloud systems for maximum performance, reliability, and scalability.

· Oversee the day-to-day operations security of cloud infrastructure in Azure and Amazon Web Services (AWS) cloud environments. 

· Define and report on metrics relating to Cloud platform Information Security

· Keep up to date, make recommendations, and participate in the implementation and continuous improvement of cloud related technologies and services in assigned information security domains

· Create and maintain Information Security related documentation related to Cloud system, network infrastructure and compliance.

· Participate in defining and implementation of the automation processes for cloud operations.

· Work to ensure security best practices, penetration testing, certifications are maintained.

· Identify, participate in remediation and document any identified system vulnerabilities.

· Stay up to date in job knowledge by studying relevant tools, techniques, and equipment; participating in educational opportunities; reading professional publications; participating in professional organizations.

· Provide leadership to the staff who implement the development, design, optimization and ongoing support of technical information systems infrastructure platforms and IT support services.

· Maintain documentation to facilitate PCI, SOC and client audits.

· Inform and advise leadership on information system technologies’ functionality, costs, benefits, resources, and implementation requirements.

· Protect operations information by keeping information confidential.

· Build trust and effective relationships with peers and provides leadership across the enterprise.

· Perform other duties as assigned.

WHO WE ARE LOOKING FOR:

· Experience as an IT Cloud Engineer or Security Engineer designing, building and launching products that customers love and have a real business impact.

· Problem framing – you can cut through the noise and laser focus on what really matters.

· Strategic thinker, with the ability to dive into details, unfazed by technology complexity.

· Strong ability to translate product needs to technology and understand technology. Detail-oriented, undaunted by technical detail, committed to flawless execution.

· Excellent verbal and written communication skills. Team player: ability to interface and build relations at all levels internally and externally.

Requirements

KNOWLEDGE SKILLS & ABILITIES

POSITION REQUIREMENTS:

Experience:

• 5 to 7 years overall working IT Systems and/or Information Security experience.
• 3 years of experience managing and maintaining production systems security in both Microsoft Azure and Amazon Web Services.
• 2 years of experience in managing production-critical cloud infrastructures and DevSecOps environments.
• 2 years of experience with Key Management and Key Management policies leveraging Azure or AWS Key Vaults.
• 2 years of experience reviewing and auditing IAM in Azure (Application integration, Azure AD, SSO setup, Token lifecycle management, writing IAM policies) and external IDPs like Okta.
• 2 years of IT operations in a PCI DSS, Service Organization Controls (SOC), and ISO 27001:2013 compliant organization. Or equivalent experience in a regulated industry.
• Experience with vulnerability management, penetration testing, and participating in ongoing security hardening projects.
• You are OS agnostic, highly proficient with and can support Linux, Windows, and MacOS 
• Experience with Ticketing systems like Jira, Zendesk, Remedy desired
• Is a strong self-starter that is operationally-focused problem-solver
• Excellent interpersonal and communication skills, user understanding and empathy, cross-group experience, working with customers, and an ability to plan and manage a portfolio of related features.

Minimum Education/Experience:

Bachelor’s degree (BA or BS) from an accredited college or university plus a minimum of four (4) years of experience in the specific or related field. Or High School Diploma or equivalent plus a minimum of eight (8) years of IT systems experience in the field.

Certifications:

· GIAC Cloud Security Automation (GIAC) certificate desirable.

· Azure and/or AWS Identity and Access Management (IAM) certification desirable.

· Microsoft Certified: Azure Security Engineer Associate desirable

· Certified Information Systems Security Professional (CISSP) or Certified Cloud Security Professional (CCSP) a plus.

Company / Industry Knowledge:

Prior experience in regulated industries like financial services or healthcare desirable.