Cloud Security Engineer

Zealogics Inc; New York (NY); On-site; USD 140,000 - 180,000; Full time

Job summary

Zealogics Inc. is seeking an experienced security-focused software engineer to implement Morgan Stanley specific security policies within CI/CD tooling.

You will work across Development, DevOps, and Security teams to automate security and compliance within DevSecOps workflows. You will define code-level security rules for apps in .NET, Java, React, and Python, and help maintain a secure platform that enforces security controls.

Qualifications

• 5+ years software development experience using Python.
• Working with APIs, including REST.
• Unit testing frameworks.
• Multi-process and multi-thread architecture.
• 5+ years in Linux, strong Bash scripting skills.
• Deep understanding of CI/CD pipelines.
• Windows environment scripting (DOS/BATCH).
• Bachelor’s degree with 10+ years of IT experience.
• Ability to process large datasets for reporting and analysis.
• Knowledge of SAST and OSS technologies is a plus.
• Experience with Jenkins, GitHub Actions, TeamCity is desirable.

Responsibilities

• Be part of a team of engineers to implement Morgan Stanley specific security policies in CI/CD security tools (SAST, OSS, SCA).
• Collaborate with Development, DevOps, and Security teams to automate security and compliance in DevSecOps processes.
• Define security rules at the code level for web and mobile apps (.NET, Java, React, Python).
• Provide a secure, stable platform to enforce application security controls.
• Support security standards and design patterns to enhance resiliency and scalability of the security platform.
• Work with partners to implement and optimize security measures in GitHub repositories to protect against vulnerabilities.

Skills

Python programming

Linux

CI/CD pipelines

Bash scripting

REST APIs

Unit testing frameworks

Multi-threading / multi-processing

Windows scripting (DOS/BATCH)

Data reporting & analysis

Code reviews

Education

Bachelor’s degree in IT or related field

Tools

Jenkins

GitHub Actions

TeamCity

Kubernetes

Docker

Puppet

Open source scanning tools

Job description

• Be part of a team of engineers to implement Morgan Stanley specific security policies in the CI/CD security tools including but not limited to SAST, OSS and SCA applications.
• Work with Development, DevOps and Security teams to identify and develop automated security and compliance capabilities in support of DevSecOps processes.
• Define the security rules that needs to be adhered to at a code level in web and mobile applications written in .NET, Java, React, Python and other languages.
• With your development background and security knowledge, provide secure stable platform for enforcing application security controls.
• Support security standards, design & implement architectural patterns to increase the resiliency and scalability of security platform.
• Work with our partners to implement, manage, and optimize security measures within our GitHub repositories to continuously improve code integrity and protect against vulnerabilities.

Required skillset:

• Must have: 5+ years software development experience using Python
• Working with APIs, including but not limited to ReST
• Unit testing frameworks
• Multi-process and multi-thread architecture
• Must have: 5+ years in linux, strong bash scripting skills.
• Deep understanding of CI CD pipelines
• Working knowledge of windows environment, simple scripting dos-batch etc.
• Bachelor’s degree with 10+ years of work experience in the IT field
• Ability to process large datasets for reporting and analysis.

Desired Skillset:

• A self-starter, with a strong desire for learning new technologies and applying them to solve problems
• Knowledge of SAST, OSS technologies
• Ability to perform Python code reviews with minimal assistance
• Expertise in monitoring, alerting, reporting, data analysis is desired.
• Experience with application build environments like Jenkins, GitHub Actions, Teamcity etc.
• DevOps container/orchestration tools (Kubernetes, Docker, Puppet, etc) is a plus
• Experience with evaluation, integration and onboard of security tools such as DAST, RASP, WAF, vulnerability scanner results, container analyzers, open source scanning is a plus