Cloud Ops Security Engineer

Job Summary (List Format): - Monitor and Manage SIEM: Responsible for daily detection and triage of security alerts using Wazuh SIEM, including tuning rules and integrating cloud audit logs (AWS CloudTrail, Google Cloud Audit, Azure Monitor), WAF, identity, and EDR data. - Incident Response: Lead incident response processes by executing IR runbooks, containing threats, investigating incidents, documenting findings, and conducting post-mortems, with authority for escalation and action. - Infrastructure Hardening as Code: Implement and maintain security baselines using Infrastructure-as-Code (IaC) guardrails and golden images to prevent configuration drift. - Cloud Posture Management: Continuously identify and address cloud misconfigurations such as public storage exposure, over-permissive IAM, open security groups, and unencrypted data. - Vulnerability Management: Perform vulnerability scans on operating systems, dependencies, and cloud resources, assess severity, and drive remediation efforts to closure within defined SLAs. - Web Application Security Testing: Integrate automated security testing tools (e.g., ZAP, Semgrep) into CI pipelines, advise delivery teams on remediation, and ensure security best practices are followed. - Identity and Access Governance: Enforce security controls including MFA, least privilege, conditional access, and effective management of user lifecycle events (joiner/mover/leaver). - Secrets Management: Operate secrets vaults, enforce use of short-lived credentials, manage secret scanning tools (e.g., Gitleaks, TruffleHog), and remove long-lived credentials from endpoints. - Security Policy Development: Draft and update security policies related to credentials, logging, access, and incident response, aligning with ISO 27001 controls, with enforcement handled by management. - Security Advisory: Provide security guidance for new projects, conduct threat modeling, review architectures prior to launch, and deliver developer security awareness training. Required Skills Summary: - 3+ years of hands-on experience in cloud or application security (CREST Certified preferred). - Deep expertise in AWS security; working knowledge of GCP and Azure. - Experience with SIEM operations (Wazuh or similar), log analysis, and alert tuning. - Proficiency in WAF, IAM, network security, and cloud-native security controls. - Familiarity with DAST/SAST tools in CI environments (ZAP, Semgrep), dependency scanning, and secret scanning. - Experience with Infrastructure-as-Code tools (Terraform or CloudFormation) for implementing security guardrails.