Security Engineer, Orkes

• Experience: DevSecOps or related role (DevOps, security engineering, etc.) in a software development environment
• Strong Understanding of DevSecOps Practices: Solid grasp of integrating security within the software engineering lifecycle and managing security through automation
• Cloud Platforms: Hands-on experience with atleast one of the major cloud providers like AWS, Azure, or GCP, focusing on cloud security best practices (e.g., securing S3 buckets, IAM roles, VPC security)
• Infrastructure as Code: Experience with infrastructure-as-code (IaC) tools like Terraform, CloudFormation, or Ansible
• Familiarity with Java /Golang /C++
• Security Tools: Proficiency with security tools like vulnerability scanners (e.g., OWASP ZAP, Nessus), security testing tools (e.g., SonarQube, Checkmarx), and log management tools (e.g., Splunk, ELK Stack)
• Container Security: Familiarity with securing containerized applications (Docker, Kubernetes) and managing container security tools
• Scripting & Automation: Strong proficiency in scripting languages (e.g., Python, Bash) to automate security processes and tasks
• Version Control & CI/CD: Experience with version control (Git) and CI/CD tools like Jenkins, GitLab CI, or CircleCI, with security best practices implemented at every stage
• Compliance & Risk Management: Knowledge of relevant security standards (e.g., OWASP, NIST) and how to implement them in a fast-paced software environment

Desirable

• Orkes is seeking a talented UI Engineer who also has backend experience and a passion for designing and building user interfaces with a developer-focused mindset. You will work closely with our engineering teams, treating developers as customers, to deliver high-quality, responsive, and user-friendly web applications
• In addition to your frontend work, you will collaborate with backend engineers to ensure seamless integration between the frontend and backend services
• Monitor and improve security tools integrated into the CI/CD pipelines (e.g., static code analysis, dynamic testing, dependency vulnerability checks)
• Automate security testing to run at each stage of the software delivery process, ensuring fast and secure releases
• Audit and monitor cloud security in all 3 major cloud providers to ensure configurations follow best practices, particularly for IAM roles, encryption policies, and VPC/network settings
• Regularly scan for vulnerabilities in code repositories, third-party dependencies, and infrastructure, using tools like OWASP ZAP, SonarQube, or similar
• Develop and maintain scripts to automate repetitive security tasks, such as vulnerability scanning, compliance reporting, and incident response
• Secure containerized applications by applying best practices for Docker and Kubernetes security, including image scanning, runtime monitoring, and applying security patches to containers
• Set up and enforce security policies for microservices and container orchestration, ensuring containerized environments remain secure and resilient to attacks
• Monitor security logs and alerts for signs of breaches, misconfigurations, or other suspicious activity using a SIEM or logging tools (e.g., ELK Stack, Splunk)
• Investigate and respond to potential security incidents, conducting root cause analysis, and applying lessons learned to prevent future incidents
• Document and improve incident response plans, preparing the organization for faster and more effective responses to potential threats
• Ensure ongoing compliance with security policies, industry standards (e.g., SOC 2, GDPR, ISO 27001), and regulatory requirements as the company scales
• Set up and maintain centralized logging and monitoring for infrastructure and application security, ensuring the team has visibility into potential security risks
• Evaluate new security tools and technologies that can improve the company’s security posture and automate routine security tasks
• Reports to: CTO