Cyber Security Engineer

Job Purpose:

The Security Engineer is responsible for safeguarding both cloud and on-premises infrastructures by designing, implementing, and maintaining security controls that protect company assets, systems, and data. This role plays a key part in vulnerability management, incident response, and security monitoring — ensuring compliance with internal and international standards.

Responsibilities:

Security Architecture & Implementation

• Design and maintain secure architectures for AWS and on-premises environments, implementing security groups, IAM policies, GuardDuty, Security Hub, and WAF configurations.
• Integrate CDN and WAF providers such as Cloudflare, EdgeNext, and CDNetworks for DDoS mitigation, bot management, and web-application protection.
• Work closely with Network and Systems teams to implement secure routing, VPN (Connexa, OpenVPN), and firewall policies (Juniper, Cisco ASA).
• Enforce Zero-Trust and least-privilege principles across all systems and cloud workloads.
• Harden and patch on-premise servers supporting corporate services (OS-level hardening, patch management, endpoint protection/EDR), in coordination with the Systems team.
• Maintain continuous cloud security posture management (CSPM) and configuration-drift monitoring (e.g., AWS Config) across AWS accounts.
• Classify and monitor sensitive data at rest (e.g., AWS Macie) to support DLP coverage in the cloud.
• Own privileged access management (PAM) and secrets management (e.g., HashiCorp Vault, AWS Secrets Manager), including MFA and just-in-time access for sensitive systems.

Application Security & DevSecOps

• Integrate SAST, DAST, and software composition analysis (SCA) into the GitLab CI/CD pipeline to catch vulnerabilities before release.
• Promote secure coding practices (OWASP Top 10, input validation, parameterized queries) with Development teams to prevent injection-type vulnerabilities.
• Tune WAF rules (Cloudflare, Nginx) to detect and block injection and other application-layer attack patterns, in coordination with the Network Engineer.
• Secure containerized workloads and CI/CD pipelines, including image scanning, where applicable.
• Own post-incident review and remediation tracking for application-layer security incidents.

Threat Intelligence & Monitoring

• Operate and maintain OpenCTI (Open Cyber Threat Intelligence) to collect, correlate, and analyze threat intelligence feeds and indicators of compromise (IOCs).
• Correlate OpenCTI data with SIEM logs and GuardDuty findings to improve detection capabilities.
• Contribute to the creation of actionable threat reports and share intelligence with incident response and SOC teams.
• Continuously assess new and emerging threats affecting the company's infrastructure and cloud footprint.

Data Loss Prevention (DLP) & Compliance

• Manage and monitor Data Loss Prevention (DLP) alerts and workflows (e.g., Digital Guardian or Microsoft Purview DLP).
• Investigate, validate, and classify DLP alerts to ensure proper escalation of potential data leaks.
• Work with managers and department heads to validate incidents, document findings, and implement corrective actions.
• Ensure adherence to security standards and compliance frameworks (e.g., ISO 27001, NIST 800-53, GDPR).
• Develop and maintain incident validation and DLP record-keeping templates for audits and reporting

Vulnerability Assessment & Penetration Testing (VAPT)

• Plan, perform, and document Vulnerability Assessments and Penetration Tests across both on-premises and cloud systems.
• Coordinate remediation activities with Network, Systems, and DevOps teams to ensure timely patching of identified vulnerabilities.
• Use tools such as Nessus, OpenVAS, Metasploit, Burp Suite, and AWS Inspector to assess infrastructure and application security posture.
• Track vulnerabilities and mitigation status through centralized dashboards and weekly reports.

Security Automation, Incident Response & Continuous Improvement

• Automate detection and response processes using Terraform, GitLab pipelines, and AWS automation workflows (Lambda, EventBridge).
• Participate in incident response, performing root-cause analysis and implementing preventive measures.
• Conduct regular security awareness training, tabletop exercises, and post-incident reviews.
• Recommend and implement continuous improvements to strengthen overall security posture of the infrastructure.
• Build and own security orchestration, automation and response (SOAR) playbooks to automate common incident-response steps.
• Own and maintain the formal incident response plan, ensuring it reflects lessons learned from past incidents.

AI & Emerging Technology Security

• Assess and govern security risk from AI tools and platforms used internally, including data handling, access controls, and exposure from AI-assisted workflows.
• Evaluate emerging AI-specific attack patterns (e.g., prompt injection, model/API abuse) relevant to the company's AI usage.
• Secure any AI/LLM integrations in company products, covering data handling, input validation, and access control.
• Explore AI-assisted detection (e.g., anomaly detection, log triage) to strengthen the security monitoring stack.

Documentation & Collaboration

• Maintain up-to-date documentation including security architecture diagrams, threat models, risk registers, and incident reports.
• Collaborate with Network Engineers, System Administrators, and DevOps to ensure alignment between security, performance, and availability goals.
• Support audits, compliance reviews, and risk-assessment exercises by providing detailed evidence and reports

Qualifications:

• Bachelor's degree in information security, Computer Science, or a related field.
• Minimum 5 years of experience in infrastructure or cloud security engineering.
• Strong hands-on expertise in:
• Threat Intelligence: OpenCTI or similar platforms (MISP, TheHive)
• DLP Tools: Digital Guardian, Microsoft Purview DLP, or equivalent
• VAPT: Nessus, OpenVAS, Burp Suite, Metasploit, AWS Inspector
• Cloud Security: AWS GuardDuty, Security Hub, IAM, WAF
• Network Security: Juniper Firewall, Cisco ASA, Nginx WAF, VPN (Connexa/OpenVPN)
• CDN Security: Cloudflare, EdgeNext, CDNetworks
• Automation: Terraform, GitLab CI/CD pipelines
• Application Security: SAST/DAST/SCA tooling (e.g., SonarQube, Snyk, OWASP ZAP), secure code review
• Identity & Secrets Management: PAM and secrets management tools (e.g., HashiCorp Vault, AWS Secrets Manager)
• Cloud Security Posture: CSPM/configuration monitoring (e.g., AWS Config) and data classification (e.g., AWS Macie)
• Solid understanding of TCP/IP, DNS, HTTP/S, SSL/TLS, VPN, SIEM, and IDS/IPS concepts.
• Preferred certifications:
• AWS Security Specialty, CompTIA Security+, CEH, CISSP, or ISO 27001 Lead Implementer/Auditor
• Strong analytical mindset, excellent incident handling, and documentation skills.
• Proactive and collaborative, with a strong sense of accountability and security ownership.

(*) BONUSES & REWARDS

• Competitive Salary

• 13th Month Salary & Performance Bonus

• Employee of the Year Award

(*) TRAINING & DEVELOPMENT

• In-house & Overseas Training

• Full reimbursement for international Technical Certification

• Global career opportunity

(*) ANNUAL PAID LEAVES

• Vacation Leave: 14 days per year

• Medical Leave: 4 days per year

• 1 extra seniority day for every 5 years of service

(*) HEALTHCARE

• Annual Routine Check-up

• Premium Healthcare Insurance (Generali)

• Comprehensive Insurance

(*) WELLNESS AND LEISURE ACTIVITIES

• Annual Team Building

• Soccer & Badminton Club and Sports activities

• Entertainment activities: Music band, Karaoke & Play-station time

• Celebrations special events: Birthdays, Christmas, New Year/Year-end Party.

(*) PERKS

• Fruits Days Twice a Month

• Unlimited snacks & beverages