Relomote
B2

Senior DevSecOps Engineer (Infrastructure & Cloud Security)

B2BrokerEngineering & Development
Hiring from
Worldwide
Work type
Remote
Posted
Is this job info correct?
Apply for this job

544,347 remote jobs, straight from company career pages

100% free · New jobs every hour

Show job description

Responsibilities

  • Define and enforce the security architecture for AWS and Azure: organisation and landing-zone design, service control policies and Azure Policy, network segmentation and private connectivity, encryption and key management (AWS KMS, Azure Key Vault), logging and monitoring baselines.
  • Own the perimeter and edge: WAF and DDoS protection, VPN and zero-trust access, DNS, certificate, and exposure management for anything internet-facing.
  • Run vulnerability management end to end: asset discovery, scanning, prioritisation by exploitability and business impact, remediation SLAs tracked with the infrastructure team.
  • Design security into new infrastructure from the start: threat-model and review architecture changes, define secure patterns other engineers can reuse, and say “no” with a workable alternative when needed.
  • Own Active Directory: administrative tiering, privileged-group hygiene, Group Policy and Conditional Access baselines
  • Design and run the group access model: least privilege across AWS IAM, Azure RBAC, Kubernetes RBAC, databases, network devices and SaaS; single sign-on and phishing-resistant MFA everywhere; privileged access management with just-in-time elevation for administrators; tested break-glass procedures.
  • Own the security telemetry pipeline into the SIEM: AWS CloudTrail, AD and Entra sign-in and audit logs; EDR; Kubernetes audit logs; WAF, VPN, network and application logs. Decide what is collected, for how long and at what cost.
  • Treat security as code: Terraform modules with secure defaults; policy-as-code (Open Policy Agent, AWS Config rules, Azure Policy) enforced in pipelines and at runtime; drift detection and automatic remediation where safe.
  • Own API security for internal and client-facing APIs (REST, WebSocket, FIX and streaming market-data interfaces): authentication and authorisation patterns, token and key handling, rate limiting and abuse protection, gateway and WAF rules, schema validation, logging of security-relevant events.
  • Automate evidence collection and continuous control monitoring so that ISO 27001 and SOC 2 audits become a by-product of normal operations.
  • Be the technical owner of the ISO/IEC 27001:2022 Annex A technological controls (A.8) and of SOC 2 (Security and Availability criteria) control operation. Support internal audits, surveillance audits and SOC 2 Type II fieldwork.
  • Map technical controls to DORA: the ICT risk-management framework, the annual digital operational resilience testing programme (vulnerability assessments, penetration tests, scenario tests, readiness for threat-led penetration testing) and the technical inputs to the ICT third-party register.
  • Run security reviews of ICT third parties and cloud services. Maintain shared-responsibility and data-flow documentation.

Requirements

  • Experience. 6+ years of hands-on infrastructure, cloud or security engineering, of which 3+ years with security as your primary responsibility, in a regulated financial-services environment — brokerage, trading, payments, banking or crypto services.
  • AWS and Azure in production. Security of complex, multi-account / multi-subscription, hybrid estates on both platforms: IAM and RBAC, networking and private connectivity, KMS and Key Vault, logging and native detection services, landing zones and policy enforcement. You have designed infrastructure, not only reviewed it.
  • Active Directory. Deep, practical knowledge of AD — tiering, Group Policy, Conditional Access, hybrid identity, the common attack paths and how to close them — plus enterprise IAM and PAM design and access-rights governance.
  • Detection and response. You have built and tuned SIEM and EDR detections, owned alerting quality and run security incidents end to end under time pressure. You understand how a Security Operations Center works from the inside — as well as what a SOC 2 report is.
  • Automation. Terraform (or equivalent IaC), CI/CD security gates, Kubernetes and container security, policy-as-code, and confident scripting in Python, Bash and PowerShell. You understand APIs well enough to secure them and to automate through them.
  • Crypto-asset infrastructure. Hands-on exposure to securing wallet or key-management systems, exchanges or crypto payment rails — HSM or MPC signing, hot/cold segregation, transaction-flow monitoring.

Conditions

  • Reliability: official employment from the first day, bonuses, annual employee review (salary review or bonus, feedback on work results)
  • Stability: our clients are in different countries, therefore we are ready for any changes in work of any country
  • Development: a lot of projects and products, which means increasing expertise in working with different technologies, or even switching to completely new ones for you within the company
  • Active corporate life: we participate in thematic conferences and forums in our cool sphere of business, corporate parties in the best restaurants of the city with participation of stars, etc
  • Comfort: Offices are in different countries. You can work from anywhere in the world
Share this job opening

Similar jobs