Full-Time Senior DevSecOps Engineer

ORCID is seeking a Senior DevSecOps Engineer to serve as an technical advisor and implementor to ensure the ongoing security of ORCID products and service offerings. The Senior DevSecOps Engineer reports directly to the Director of Technology but is also functionally accountable to the Director of Operations and the Director of Product as seamless, matrixed partnership across ORCID units will be key to the success of this role. 

This position is full time (40 hours/week) and, like all positions at ORCID, is fully remote. Candidates must be able to work during Europe or Americas standard business hours (Mon-Fri) with at least four hours daily between 1300-2000 UTC, with some recurring meetings between 1400 - 1700 UTC. Outside of these parameters, ORCID offers flexibility with your schedule.

Responsibilities

• Work with ORCID senior staff, product, technology, and devops teams to identify the right architecture to ensure the secure  implementation of new solutions, products and modules. 
• Develop, implement and maintain product security strategy for the ORCID product portfolio
• Conduct complete lifecycle security architecture and technical assessments for a wide range of product infrastructure, databases, web applications, and internal/SaaS software solutions.
• Identify and work with the ORCID product and technology teams to mitigate security risks in the product and infrastructure.
• Collaborate with the product and technology teams to ensure security best practices are integrated into the development lifecycle (SDLC) to reinforce “security by design” concepts.
• Provide guidance and leadership on best practices regarding security in software and product development.
• Analyse and prioritise vulnerabilities identified by developers, customers, testers, as well as automated static and dynamic application security testing. Work closely with developers to remediate in alignment with the identified risk to ORCID systems, users, and data.
• Implement or guide the implementation of common application security controls
• Ensure privacy requirements are implemented through data protection and security technology both within ORCID products and internal/SaaS tools.
• Work with the ORCID operations team on the selection and secure configuration of internal/SaaS tools.
• Identify and work with the ORCID operations team to mitigate security risks in internal and SaaS tools.
• Provide training and education to developers on software security best practices.
• Participate in the on call rotation for out of hours support, and respond to extraordinary situations or technical emergencies

Requirements and Qualifications 

Required Skills:

• Proven experience as a DevSecOps engineer or similar role involving securing a user-facing product. (4-6 years)
• Experience translating OWASP Top 10 into practical development imperatives and applying to product infrastructure (4-6 years)
• Knowledge of and experience with best practices in the union of security engineering and DevOps (2-3 years)
• Experience with cloud services (e.g. AWS), their native services, and security features. (3-4 years)
• Experience securing databases including access control and encryption whilst maintaining performance (2-3 years)
• Experience with integration and release pipelines and the security of tools such as GitHub Actions or other similar modern CI platform (2-3 years)
• Familiarity with the security of containerisation technologies such as Docker and Kubernetes. (2-3 years)
• Knowledge of Terraform, network security architectures, network access controls, and secure network design. (2-3 years)
• Strong problem-solving skills
• Ability to work well in teams and across the organisation.
• Self-starter. Ability to define the problem at hand, recommend solutions, and drive to results
• Strong communication skills, with the ability to explain complex concepts to colleagues across an entire range of technical capabilities from non-technical to highly-technical.

• Fluency in English required. Additional languages a plus.
• Ability to travel based upon business needs (less than 10%)

Nice to have:

• Previous experience in enterprise security tools
• Proficiency with securing and addressing security issues within programming languages such as Python or Java. (3-4 years) Previous experience as a practising developer is an additional plus.