Find your next role

Introduction

A career in IBM Infrastructure means you'll be part of a team that transforms our customers challenges into solutions.

Seeking new possibilities and always staying curious, we are a team dedicated to creating the world's leading AI-powered, cloud-native software solutions for our customers. Our renowned legacy creates endless global opportunities for our IBMers, so the door is always open for those who want to grow their career.

We are seeking a skilled Cloud Security and Compliance Engineer to join our IBM Cloud Privileged Access Gateway team. As part of our team, you will be responsible for developing and maintaining high-quality software products, working with a variety of technologies and programming languages.

IBM's product and technology landscape includes Research, Software, and Infrastructure. Entering this domain positions you at the heart of IBM, where growth and innovation thrive.

Your role and responsibilities

The IBM Cloud Privileged Access Gateway team is growing and looking to add a Cloud Security and Compliance Engineer to its team of skilled architects and developers. We are seeking a passionate and experienced Cloud Security and Compliance Engineer to join our team. This role is pivotal in ensuring our cloud services meet the highest standards of security and compliance. You will work cross-functionally with engineering teams, project managers, and compliance stakeholders to identify, implement, and monitor security controls and processes. Your work will directly contribute to the protection of our infrastructure, data, and services.

In their adoption of cloud, large enterprises need to transform their legacy tools and processes into cloud-age concepts. IBM is committed to helping its valued customers in making that transformation. For regulated industries (healthcare, payment, financial services, and others), one of the key aspect of compliance revolves around strict control and traceability of system access, and particularly changes made to them.

The right candidate particularly thrives in cloud security concepts and application, experience with one or multiple security and compliance frameworks (FedRamp, PCI, etc) and has excellent spoken and written communication skills. Strong understanding of agile development and customer-facing experience are needed to hit the ground running. The role is perfect for someone with a broad mix of technical knowledge, and demonstrated background on security aspects and solutions for regulated industries.

Key Responsibilities

• Support security and compliance initiatives across services.

• Collaborate with development and operations teams to mitigate security risks.

• Implement, and monitor security controls and compliance processes.

• Contribute to risk assessments, gap analyses, and remediation planning.

• Support internal and external audits by providing evidence and documentation.

• Support adherence to regulatory standards such as FedRAMP, HIPAA, GDPR, SOC 2, PCI, ISO27K, NIST, ISMAP, ENS, HITRUST, etc.

• Drive improvements in patch management, vulnerability management, and access control.

• Maintain accurate asset inventories and ensure configuration management best practices.

• Monitor logs and systems for anomalies and respond to incidents.

• Participate in penetration testing and threat modeling exercises.

• Communicate security requirements and findings to technical and non-technical stakeholders.

• Manage vulnerabilities for the service and work with the service team to ensure timely remediation of identified vulnerabilities.

• Serve as the audit focal point and review artifacts for various audit programs.

• Coordinate with internal teams and both internal and external auditors to ensure compliance with regulatory requirements and industry best practices.

• Conduct risk assessments, identify gaps, and provide recommendations for risk mitigation and process improvements.

• Conduct process analysis to identify manual tasks suitable for automation, and collaborate with teams to document requirements for automation projects.

Required education

Bachelor's Degree

Preferred education

Master's Degree

Required technical and professional expertise

• 7+ years of demonstrated experience in successful driving and execution of compliance programs for common IT security standards/regulations: SOC1/2/3, ISO27K, HIPAA, PCI, FBA (formerly FFIEC), FedRAMP, GDPR, etc.

• Knowledge of end-to-end Security and Compliance activities such as Threat Models, Security Privacy by Design.

• Experience with cloud technologies and infrastructure.

• Familiarity with serverless services, containerization.

• Knowledge of Security scanning tools such as Nessus scanner, SonarQube, NMap.

• Knowledge of Security concepts (includes understanding of identity mgmt./authentication, authorization, firewall, auditing, secure communication, managing certificates, password management).

• Strong understanding of access management, data protection, and secure system configuration.

• High-level understanding of Cloud infrastructure & industry transformation

• Solid organizational skills including attention to detail and multitasking skills

• Excellent communication and documentation skills.

• Ability to work independently and collaboratively across teams.

Preferred technical and professional experience

• Experience with various scripting languages (Python, Golang, Bash, etc.).

• Experience with microservice architectures and Restful API development

• IT Security experience and/or certification (CISSP, or equivalent)

• Experience with geographically distributed teams

• Experience in DevSecOps pipelines - Jenkins, Tekton Toolchains

• Familiarity using Container Security tools such as Prisma Cloud & AquaSec

• Exposure on Kubernetes/OpenShift environments.

Ideal Candidate Traits:

- Information Research: Keen ability to search for information, gather relevant data, and utilize resources effectively to support compliance and audit activities.

- Self-Starter: Demonstrated ability to take initiative and work independently without needing tasks to be assigned, proactively identifying and addressing issues.

- Problem-solving: Strong problem-solving skills to address compliance issues and improve processes.

- Attention to Detail: Meticulous attention to detail to ensure accuracy and compliance with regulatory standards.

- Communication Skills: Excellent verbal and written communication skills to coordinate with internal teams and auditors, and to document compliance processes.

Years of Experience:
7 - 15