Security Engineer

Security Engineer
Company:

Standard Bank


Place:

Gauteng


Area:

Programmer

Security Engineer

Details of the offer

Standard Bank1,274 reviews-Standard Bank1,274 reviewsRead what people are saying about working here.Johannesburg, GautengStandard Bank is a firm believer in technical innovation, to help us guarantee exceptional client service and leading edge financial solutions. Our growing global success reflects our commitment to the latest solutions, the best people, and a uniquely flexible and vibrant working culture. To help us drive our success into the future, we are looking for an experienced Security Engineer to join our team at our Johannesburg offices. Standard Bank is a leading African banking group focused on emerging markets globally. It has been a mainstay of South Africa's financial system for 150 years, and now spans 16 countries across the African continent.
Job Purpose
Make the bank more secure by assisting projects and IT delivery teams make the right decisions when planning and implementing security measures to monitor and protect sensitive data and systems from infiltration or misuse. Provide leadership and guidance to more junior security engineers.
Key Responsibilities/Accountabilities
Provide Security Engineering Expertise
Act as subject matter expert with regards to security engineering activities, by advising projects, business areas and other engineers on how to implement cyber security controls correctly;
Designing, engineering, planning, implementing, and supporting security solutions by working with projects and business areas from initial design through build and test to providing 2nd line support in production;
Develop detailed security designs that are practical and align to architectural requirements by working with architects and software engineers to realise how cyber security technologies should be implemented;
Actively participates in the day-to-day technical tasks, either project related or incident related, by attending meetings, reviewing deliverables and performing post incident analysis;
Design and develop authentication, authorization, auditing, data at rest encryption, key management, and other security features.
Provide configuration assistance and troubleshoot implementation issues with security solutions by reviewing tests, implementations and incidents and recommending better ways of working;
Automate security process to reduce as much manual effort as possible
Build integrations between various alerting, metrics, and logging systems
Build and operate Cloud scale infrastructure which supports and secures the cloud environment
Develop tooling to make security frictionless for cloud tenants
Utilize expertise in Cloud to assist the team in its efforts to maintain the security environment throughout migrations
Utilize cloud-based APIs when appropriate to write network/system level tools for securing cloud environments
Guide Major Programs in making security decisions
Assist projects with practical guidance in unpacking and implementing system security requirements, by working with projects in designing and configuring cyber security technologies appropriately;
Assist with the Prototype and Pilot of proposed security solutions by working with projects or running prototypes and pilots to demonstrate the viability of a cyber security control technology;
Provide configuration assistance and troubleshoot implementation issues with security solutions by reviewing tests, implementations and incidents and recommending better ways of working;
Evaluates new technologies against established requirements and validate the security of the technology
Provide leadership, guidance and management to more junior security engineers and other non security technical personnel.
Plan and allocate engineering activities, balancing risk to business and demand from projects by forecasting what effort is required on which projects and directing more junior engineers and technical personnel appropriately;
Coach and develop engineers and technical personnel as part of their careers in the engineering function;
Manage the workload, quality and performance of more junior engineers and technical personnel through balanced work assignment, regular review of work done and intervention where quality needs to be improved, in the context of the overall engineering function;
Demonstrate how security can be implemented by project and feature teams without the need for hands on security engineers
Document practical and useful guides that can be used by technical personnel to help themselves implement effective security
Review security implementations of other teams and provide approvals and recommendations for more effective controls
Share knowledge of effective security implementations across teams so that the benefit of good work in one area is leveraged
Assisting in design, planning, and implementation of Security controls, policies, and processes
Provide technical capability to match information security controls to business risks
Providing solutions to security and technical challenges facing the bank presently and future though understanding the evolving risk landscape and developing appropriate control measures;
Provide technical input to organisation risk management policies and standards through providing content and review to how business and risk rules can be implemented;
Finding security vulnerabilities by generating various attack scenarios for target systems under development, mapping attack paths and understanding how the bank could be compromised;
Develop countermeasures for identified security vulnerabilities through identifying candidate controls and selecting the most beneficial controls for implementation;
Develop technical solutions and new security tools to help mitigate security vulnerabilities and automate repeatable tasks, through building technical control capabilities and maturing their operational effectiveness.
Focus on Cyber Security technologies and policies to safeguard networks, data, and applications from outside threats
Preferred Qualification and Experience
Qualifications:
Degree: IT and Computer Sciences
Certification in CISSP, SABSA F1/F2/A1/A3,CISM , CRISK , CCSK.
Experience:7 - 10 years' detailed technical knowledge of cloud, application, database, integration, operating system, and network security controls and how they should be tested.
7 - 10 years' detailed technical knowledge of representing risk data to technical and business management.
5 - 7 years' cloud Security Engineering experience
More than 7 years' hands on experience in software development including integration development
More than 5 years' experience building infrastructure or applications on cloud platforms:
Knowledge of Cloud services and security controls
Knowledge of network security architecture (e.g VPNs, SSH bastions, etc)
The ability to write clean, readable, and maintainable code
Experience with Linux
Experience with log collection and analysis (e.g. Kinesis, ElasticSearch, Sumo Logic etc)
Expert knowledge of Cloud security products and services
Experience with key management tools like AWS KMS, Hashicorp Vault
Experience in using scripting languages e.g. Python, Perl, PHP, Ruby to automate tasks and manipulate data
Experience with automation tools like Ansible, Chef, Puppet, Jenkins
Experience with container security and container orchestration tools e.g. Kubernetes
Proficient within a Linux, Docker containerized environment
Knowledge of, and experience with public cloud platform (IaaS) features, capabilities
Strong knowledge industry standards regarding vulnerability management including Common Vulnerabilities and Exposures (CVE), Common Vulnerability Scoring System (CVSS) and Open Web Application Security Project (OWASP)
Knowledge/Technical Skills/Expertise
The management of, and provision of expert advice on, the selection, design, justification, implementation and operation of information security controls and management strategies to maintain the confidentiality, integrity, availability, accountability and relevant compliance of information systems.
Knowledge of business concepts, entities (definition, ownership, use, semantics and syntax) specific to Banking & Financial Services industry.
Knowledge and understanding of the standards and phases of implementing new systems or software.
The planning and implementation of organization-wide processes and procedures for the management of operational risk.
The ability to integrate system patterns between systems.
Architectural methodologies used in the design & development of IT systems.


Source: Jobs4It


Area:

  • IT - Information Technology / Programmer

Requirements