Cloud Security Engineer

Cloud Security Engineer

Responsible for analysis, design and implementation coordination for tool and service designs within the cloud security & identity domain.

General Description

The Cloud Security Engineer role, key responsibilities would include securing software built and maintained by Popular. The Cloud Security Engineer role will work closely with in-house software development teams and vendors/third-party organizations to ensure that security, privacy, and compliance requirements are planned for, designed, and built into software applications. In addition to securing software, The Cloud Security Engineer role will be expected to understand cloud computing principles, including virtualization, containerization, microservices and serverless computing. Risk management, security, container security, Kubernetes security, IAM security, network security, encryption, secrets management, data protection & securing CI/CD. It’s key to maintain industry and cyber knowledge to optimize and align Popular’s application security processes and systems throughout the Software Development Lifecycle.

Essential Duties and Responsibilities

• Complete hands-on experience with Terraform, Packer, Ansible, Json for hardening images and CI/CD pipelines
• Deep knowledge of securing API’s and Microservices platform
• Support the configuration and maintenance of API discovery, classification, and monitoring within Akamai API Security to ensure externally exposed APIs are properly identified and assessed for risk.
• Tune Akamai API Security platform detection rules, policies, and alert thresholds to reduce false positives while maintaining visibility into high-risk API activity.
• Perform periodic health checks of the Akamai API Security platform, including connector status, data ingestion, coverage validation, and policy effectiveness.
• Hands on experience with IAM ‘Policy as code’; OPA (Open Policy Agent); Cedar – AWS opensource policy agent.
• Manage and govern cloud identity and access management controls across Cloud technologies and related cloud environments to support least privilege, secure access, and compliance requirements. (Azure, AWS)
• Expertise in Dev-Ops, CI/CD and full life cycle management
• Experience working in DevSecOps, including knowledge and experience enforcing a secure software development lifecycle. (Github,Gitlab,Jenkins,Ansible,Chef,Puppet)
• Experience using scripting languages (Python,Powershell,Bash etc) to parse machine generated data, interact with REST APIs and automate repetitive tasks
• Identify solutions for common security problems while participating as a security specialist in an agile Application Security team.
• Work on security reviews, building relationships with software architects, developers, and engineers.
• Design and develop accelerators, security APIs, pipeline security automation.
• Develop, enhance, and maintain security automation capabilities that support IAM governance, access control enforcement, and compliance monitoring.
• Develop and embed secure design patterns, coding standards, education, and culture into the development community.
• Build, deploy, and automate comprehensive application security testing capabilities.
• Application security assessments, including code reviews, architecture reviews, threat modeling, and penetration testing.
• Support remediation of IAM risks across Cloud technologies such as, but not limited to, SaaS, PaaS and IaaS technologies.
• Act as an advocate and resource for secure software development and application security practices in all application life cycle phases.
• Promote API security design principles and perform API security reviews.
• Assists cyber incident triage, including determining scope, urgency, and potential impact, identifying the application code's specific vulnerability. Makes recommendations that enable expeditious remediation.
• Assist with audit, compliance, and risk management activities by gathering evidence, explaining IAM control design, and demonstrating how cloud access is governed and monitored.

Knowledge and Skills

• You are either a security-oriented software engineer who has been building software under agile processes or a security professional who wants to get closer to development and engineering.
• Strong background in developing, validating, and maintaining automated security controls and guardrails that enforce security requirements across cloud platforms. (AWS, Azure, Salesforce, etc.)
• Ability to develop and maintain security requirements, architecture guidance, standards, implementation requirements, service baselines, and operational documentation.
• Knowledge and understanding programming languages and the ability to understand code is essential. (Python, Bash/Shell, Go, YAML/JSON, Git, Ruby, SQL)
• Working knowledge developing and securing web APIs and web applications: REST, SOAP, gRPC.
• Direct hands-on skillsets with security testing of web services and web APIs.
• Hands-on experience using Terraform to define, deploy, secure, and manage cloud infrastructure through Infrastructure as Code practices.
• Hands-on experience with CI/CD tools such as GitLab, Jenkins, Nexus, Harness, Artifactory, or comparable substitutes.
• Strong knowledge of leveraging various application security testing tools in the areas of SAST, DAST, IAST & SCA such as Veracode, Qualys WAS, Checkmarx, Gitlab, DevTools, or various other commercial standard offerings for application security testing and analysis.
• Strong background in integrating security controls into several areas in the SDLC process, including automation into a CI/CD pipeline.
• Strong skillsets leveraging secure development frameworks and best practices like OWASP, STRIDE.
• Working knowledge of Swagger, Azure DevOps, SOAPUI, POSTMAN, and Visual Studio.
• Understanding of APIs, security and standard flows (OAuth, OpenIDConnect).
• Advanced skillsets support an engineering focused approach to solving common security problems.
• Direct hands-on experience with leading threat modeling exercises for applications and services.

Education/Experience

• Bachelor’s degree in computer science, Software engineering, Information Systems or related field.
• At least five years of experience in security aspects of software engineering.
• Knowledge with key application security tools, such as, Veracode, Qualys WAS, Checkmarx, Gitlab, Etc.
• Working knowledge of Swagger, Azure DevOps, SOAPUI, POSTMAN, Visual Studio.
• Strong knowledge of .Net, C#, Javascript, AngularJS and related languages.
• Knowledge with Team Foundation Server and / or Visual Studio Team Servers.
• Knowledge of security risks and risk rating methodology.
• Knowledge of cloud architecture - IaaS, PaaS, and SaaS.
• Current and prior experience with Salesforce Shield suite of security tools such as platform encryption, event monitoring, and field-level audit trails.

Preferred Certifications and Licenses

To qualify for the role, candidates shall have a Specialization Certification (preferred) and a minimum one (1) Base Certification:

Base Certifications:

Such as CISSP, CCSK, CCSP.

Specialization Certifications:

Such as CISM, AWS, CCSK, CCSP.

Important: The candidate must provide evidence of academic preparation or courses related to the job posting, if necessary.

Our hybrid workplace model is a flexible benefit designed to support the evolving needs of our organization and team members. As priorities and circumstances change, work arrangements may be adjusted to ensure alignment with organizational goals and employee well-being.

ABOUT US

Popular is Puerto Rico’s leading financial institution and have been evolving since it was founded over a century ago. From a small bank it has developed into a large corporation that offer a wide variety of services and financial solutions to our customers, with presence in the United States, the Caribbean and Latin America.

As employees, we are dedicated to making our customers dreams come true by offering financial solutions in each stage of their life. Our extensive trajectory demonstrates the resiliency and determination of our employees to innovate, reach for the right solutions and strongly support the communities we serve; therefore, we value their diverse skills, experiences and backgrounds.

We reaffirm our commitment to always offer essential financial services and solutions for our customers and communities, including during emergency situations and/or natural disasters. Popular’s employees are considered essential workers, whose role is critical in the continuity of these important services even under such circumstances. By applying to this position, you acknowledge that Popular may require your services during and immediately after any such events.

If you have a disability or need more information about requesting an accommodation, please contact us at asesorialaboral@popular.com. This email inbox is monitored for such types of requests only. All information you provide will be kept confidential and will be used only to the extent required to provide needed exemptions or reasonable accommodations. Any other correspondence will not receive a response.

Are you ready for a rewarding career?

Popular is an Equal Opportunity Employer, including Disability/Vets. Popular is a Drug Free Workplace

Learn more about us at www.popular.com and keep updated with our latest job postings at www.jobs.popular.com.
Connect with us!
LinkedIn | Facebook | Twitter | Instagram

If you are a California resident, please click here to learn more about your privacy rights.