What are we looking for??
1. You have an inquisitive mind which can identify pragmatic solutions to complex technical and security process challenges.
2. The ability to not only use security tools, but to implement them in diverse and heterogeneous environments, such as those containing a mix of workloads across discreet VMs, orchestration tools like Kubernetes or Mesos, and on-premise or cloud-native infrastructure.
3. Exhibits a good balance between strategic direction and tactical execution.
4. Experience securing Kubernetes running at scale in production on public clouds, preferably with both Linux and Windows workloads.
5. Experience with securing AWS-based cloud infrastructure and security-focused services such as AWS KMS, Cloud HSM, AWS Encryption SDK, or equivalents (e.g. from GCP), AWS IAM, and AWS STS.
6. Development and administration experience in Linux environments with distributions like Debian and Ubuntu.
7. Programming experience in languages like Java/Python/PHP/Ruby/Go/Groovy/C/C++.
8. Deep understanding of web technologies such as HTTP, TLS, and REST and services such as Nginx and HAProxy.
9. Experience with tooling and systems for build, infrastructure automation, and monitoring, such as Docker, Jenkins, Terraform, Datadog, JFrog, and Sumologic.
10. Good knowledge of security principles at all layers of the OSI stack.
11. Blue and/or red team experience is highly valued.
What you will be learning and doing?
1. Keeping up with the state of the art in application security, operational security, and DevSecOps, helping developers build software securely throughout the complete software development lifecycle.
2. Enhance the security posture of platforms and applications, securing production and pre-production services running on Kubernetes and Docker.
3. Evangelize smart security solutions and mitigations that solve classes of vulnerabilities by addressing root causes.
4. Continue to learn new technology and business processes and apply an offensive (- red team- ) security mindset to them to discover and drive improvements.
5. Hunt for and identify threats and vulnerabilities which impact software and infrastructure.
6. Continuously improve the systems and algorithms we use to identify potential indicators of compromise.
7. Apply common information security frameworks or standards utilized in the industry to understand requirements and best practices as they apply to software.
8. Leading independent third-party vendors through security assessments such as penetration testing, social engineering, and compliance.
9. Implement and maintain the security tooling
We think InfraCloud is a rocketship you should join!
InfraCloud has been working in cloud-native technologies with early innovators before Kubernetes was 1.0 and when it seemed like Mesos will become the standard! Our focus & history on an area of programmable infrastructure coupled with working with some innovative product companies give us some solid engineering challenges to work on.
From one of our hackathons was born BotKube Project which was developed by our engineers and community over the last 1.5 years. When we started developing BotKube's Microsoft Teams integration, another project was born - Go SDK for Teams. We are also the second largest contributor as a company to Fission - a Serverless framework for Kubernetes. Another time an engineer working with a telecom company added support for 128bit tracing ID in Jaeger client. These are just some examples - and there are many more - do make a point to ask the engineers you talk to about more open source work we do.
Our engineers are co-organizers of Kubernetes Pune, Docker Pune, PythonPune and can be found frequently speaking at local meetups and conferences.
Tuesday, August 04, 2020
InfraCloud - Senior Security Engineer - Vulnerability Assessment (7-12 yrs) (InfraCloud Technologies)
