CaliberMind is looking for a DevSecOps / Operational Security Engineer to work within the CaliberMind engineering team. As DevSecOps, you will ensure we deliver best practices in operational security across the business.

Who we are looking for:

• You have a sustained track record of making significant, self-directed, and end-to-end contributions to large and impactful projects. You think beyond just the task at hand to deeply understand the 'why' behind what you are doing.
• You can code. At our scale, we are not interested in “boutique” manual management. You code with languages such as Python, Typescript, Go or Java.
• You design for scale. You understand that the only way to scale is to avoid narrowly architected systems and applications. You design systems to auto-scale and auto-heal.
• You are a broadly skilled engineer with an interest in information security, risk management, service reliability, automation, and monitoring. But you have the breadth of knowledge necessary to support a wide variety of software and systems.
• You understand modern architecture. You know why Docker and containers are more than just buzzwords, but you show reluctance to allow overcomplexity and overengineering.
• You work with confidence and without ego. Our engineers have deep knowledge and exercise a high degree of leadership in their daily work, and at the same time, recognize impostor syndrome exists in everyone. You advocate for what you believe is right, are willing to be proven wrong, and are quick to support your fellow teammates.
• You value, seek out, and foster diversity. We are a team from many diverse backgrounds, with different experiences and perspectives. To complement this team, you will welcome ideas that are different from your own and be skilled at finding and building from common ground.
• You are a creative thinker not bound by "the way things have always been done". What you know is less important than how well you learn and innovate. We don't need engineers who know all the answers; we need scrappy problem-solvers who can see answers no one has thought of to questions yet to be asked.

What you will own:

• Cloud infrastructure Security: Our environment needs to be secure from the ground up. Everything needs to be built in Infrastructure as Code with built-in security checks, least privilege model and you will continue to drive this effort.
• Operational security: In an ever-evolving threat landscape, our environment must be able to withstand threats from many directions. For you, this means evaluating results from various scanning tools, liaising with our third-party providers and the wider business to fix security vulnerabilities.
• Data Loss Prevention (DLP): Maintenance, upgrading, and configuration of software and devices that provide DLP across the entire business will fall squarely in your bailiwick.
• Certifications: You will be an integral part of the company’s efforts towards ISO-27001 and SOC2 certifications.

What you will bring:

• A solid understanding and hands-on experience using the most common technologies used in GCP: Compute, SQL, Storage, Kubernetes, Pub/Sub, NAT (Dataproc is a plus)
• Demonstrable experience in operational security with a good understanding of the concept 'Infrastructure as Code' in GCP
• Working knowledge of cloud networking architecture, cloud operations, security, automation, and orchestration
• Experience in building and deploying applications on the cloud, using CI/CD frameworks and infrastructure automation, such as Terraform, Cloud Build / Jenkins.
• Knowledge of data security requirements in the cloud aligned with FISM, CJIS, PCI, HIPAA, NIST, FedRAMP, GDPR, or other rigorous security compliance standards.
• Familiarity with security issues associated with containers, distributed systems, and large-scale web applications.
• Extensive knowledge of several key security practices in access control, application security, network security, security architecture, and security strategy.
• Build automation to actively audit the infrastructure for security misconfigurations of GCP. Develop API Integrations and recommend configuration changes to improve the performance, usability, and value of cloud security tools.

What we care about:

What and how you can contribute is what’s important to us. Our consideration is not limited by the kind of education you have or the specific technologies you have experience with. A variety of technical challenges is one of the best things about working at CaliberMind as an engineer, but we do not expect you to know every technology we use when you start. What we care about is that you can learn quickly and solve complex problems using the best tools for the job.