Essential Functions/Responsibilities
Contribute to and maintain Black Duck's cloud security baseline: standards, guardrails, and reference configurations for GCP, Azure, and AWS, written so engineering teams can actually apply them.
Design, build, and operate preventive and detective controls for SaaS workloads, including identity and access (IAM, workload identity, service accounts), network segmentation, encryption and key management, secrets handling, and logging coverage.
Operate, tune, and enhance the cloud-native application protection platform (Wiz or comparable CNAPP): onboarding cloud accounts and Kubernetes clusters, writing and tuning policies and custom controls, cutting noise, and maturing coverage from agentless scanning to runtime sensors.
Triage posture, vulnerability, and identity findings by real exposure and exploitability, not by raw severity, then partner with resource owners to prioritize and complete remediation, tracked against policy SLAs.
Conduct security reviews and provide recommendations for new cloud services, architectures, and third-party integrations, using threat modeling and proofs of concept, before they reach production.
Secure containerized and Kubernetes platforms (GKE, AKS, EKS): cluster hardening, RBAC, admission control and policy as code, image provenance, and runtime protection.
Build security into CI/CD and infrastructure-as-code workflows (IaC scanning, image scanning, secrets detection, policy gates) so issues are caught before deployment rather than found in production.
Contribute to software supply chain integrity for build and deployment pipelines, consistent with Black Duck's position as a software supply chain security company.
Develop and maintain cloud detections from audit logs, control-plane events, and CNAPP signals; validate that the telemetry they depend on is actually collected.
Support the CSIRT on cloud incidents: scoping, containment, evidence preservation, cloud forensics, and remediation, including post-incident hardening.
Automate controls, enrichment, and remediation workflows using Python, Bash, cloud APIs, and infrastructure as code (Terraform, Helm).
Lead defined cloud security projects and contribute to workstreams within complex cross-functional initiatives across engineering, platform, IT, and vendor partners.
Provide technical guidance to less experienced team members, participate in peer reviews, and share cloud security best practices.
Communicate cloud security risks and recommended actions to technical teams and management, supporting senior-level discussions as needed.
Produce evidence and control documentation that supports SOC 2 and ISO 27001 audits and customer security reviews.
Keep current on cloud attack techniques, provider security changes, and emerging threats, and recommend systematic improvements.
Other tasks and activities as assigned.
Required Education/Experience & Skills
Experience: typically 5 or more years in information security, including at least 3 years hands-on securing production cloud environments at scale.
Cloud depth: in-depth conceptual and practical knowledge of at least one major provider (GCP, Azure, or AWS) and working fluency in a second, covering IAM models, networking, logging, and native security services. Production experience with GCP and Azure is a strong advantage.
Kubernetes and containers: hands-on experience securing Kubernetes clusters and container workloads in production.
CNAPP: hands-on experience with Wiz or a comparable CNAPP, especially policy development, custom controls, and runtime sensor deployment; plus cloud logging, monitoring, and vulnerability management platforms at scale.
Automation: strong Python and/or Bash for security automation and integration; comfortable working directly with cloud provider APIs.
Infrastructure as code: practical experience with Terraform, Helm, or equivalent, including reviewing IaC for security issues.
Compliance: familiarity with SOC 2, ISO 27001, and FedRAMP frameworks (framework knowledge).
Leadership: experience leading projects or parts of complex projects and building consensus across teams.
Communication: strong written and verbal English; able to explain complex or sensitive security issues to technical and executive audiences.
Education: Bachelor's degree in Computer Science, Information Security, or a related field, or equivalent practical experience. Relevant certifications are a plus (e.g., CKS, Google Professional Cloud Security Engineer, Microsoft Azure Security Engineer Associate, AWS Certified Security Specialty, CCSP, CISSP, or GIAC).
Physical Requirements
General office environment and responsibilities requiring
Extensive use of the computer which involves viewing a monitor and keyboarding for most of the workday
Placing and receiving phone calls
Occasionally moving and lifting objects up to 20 pounds
May require some travel as needed.
Black Duck is an equal opportunity employer. We consider all applicants for employment without regard to race, color, national origin, religion, sex, gender identity or expression, age, disability, sexual orientation, veteran or military service status, or any other characteristic protected by applicable law. Black Duck complies with all applicable laws prohibiting employment discrimination in every jurisdiction where it operates and provides reasonable accommodations to individuals with disabilities in accordance with applicable law.
