Security Engineer (Fractional)
亚卡尼斯是高增长的瑞士软件开发合作伙伴，在菲律宾拥有300多人业务。我们正在寻找一个安全工程师 (Fractional) 来将我们的安全姿势转变为"企业级".你是谁 （要求）: 1. 在安全工程，云安全，应用安全或 DevSecOps 方面经验证明，理想情况下是在软件，技术或外包环境中。2. SDLC,CI/CD 安全，云平台 (AWS/GCP),身份和访问管理，漏洞管理和终端安全方面的强大的技术基础。3. 能够独立评估和验证安全控制，包括审查 AWS/GCP 配置，GitHub 存储库，CI/CD 管道和安全工具，并提供实用建议。4.与客户的安全评价，安全问卷，审计或供应商评估经历。治理，风险管理，SOC 2,ISO 27001,GDPR 和其他合规经验是个优势。5.优先获得 AWS/ GCP,CISSP,CISM,CISA 等相关安全认证。6.与分布式团队 （欧洲/亚洲/澳大利亚）和初级创业公司合作的经验是一个优势。1.安全战略重点责任：· 制定12个月的安全路线图，以平衡"瑞士质量"的期望与软件外包公司的灵活性。·建立风险登记册并优先考虑基于业务影响的修复。2. 导师和团队升级 ·作为我们的 IT 经理的直接导师，将技术任务转化为安全控制。· 设立"安全办公时间",培训我们主要开发人员对安全编码 (OWASP) 和 DevSecOps. 3.跨境合规性 ·确保所有数据处理符合欧洲 GDPR,菲律宾数据隐私法和澳大利亚隐私法标准等规定。· 标准化我们对客户安全问卷答复以加速销售周期。4.事件与政策管理 · 制定和实施实用而非仅仅理论性的核心政策 （事故响应，访问控制，BCP/DR）. · 在不过于复杂的情况下监督选择和执行基本的安全工具 （EDR,SIEM,脆弱性扫描仪）5.风险投资组合安全与咨询 · 为 Arcanys Ventures 组合公司定义一个"正确尺寸"的安全框架，确保它们具有必要的保护，而不抑制其增长或速度。· 帮助领导者
查看英文原文
Arcanys is a high-growth Swiss software development partner with a 300+ person operation in the Philippines. We are looking for a Security Engineer (Fractional) to transition our security posture to "enterprise-grade".
Who you are (Requirements):
1. Proven hands-on experience in security engineering, cloud security, application security, or DevSecOps, ideally in software, technology, or outsourcing environments.
2. Strong technical foundation across SDLC, CI/CD security, cloud platforms (AWS/GCP), identity and access management, vulnerability management, and endpoint security.
3. Able to independently assess and verify security controls, including reviewing AWS/GCP configurations, GitHub repositories, CI/CD pipelines, and security tools, and provide practical recommendations.
4. Experience with client security assessments, security questionnaires, audits, or vendor assessments. Governance, risk management, SOC 2, ISO 27001, GDPR, and other compliance experience is a plus.
5. Relevant security certifications such as AWS/GCP, CISSP, CISM, CISA, or equivalent are preferred.
6. Experience working with distributed teams (Europe/Asia/Australia) and with early-stage startups is a plus.
Key Responsibilities:
1. Security Strategy
- Design a 12-month security roadmap that balances "Swiss Quality" expectations with the agility of a software outsourcing firm.
- Establish a Risk Register and prioritize remediation based on business impact.
2. Mentorship & Team Elevation
- Act as the direct mentor to our IT Manager, transforming technical tasks into security controls.
- Establish "Security Office Hours" to train our lead developers on secure coding (OWASP) and DevSecOps.
3. Cross-Border Compliance
- Ensure all data handling meets the European GDPR, the Philippines Data Privacy Act and the Australian Privacy Act standards, among other regulations.
- Standardize our response to client security questionnaires to accelerate the sales cycle.
4. Incident & Policy Management
- Draft and implement core policies (Incident Response, Access Control, BCP/DR) that are practical, not just theoretical.
- Oversee the selection and implementation of essential security tools (EDR, SIEM, Vulnerability Scanners) without over-complicating the stack.
5. Venture Portfolio Security & Advisory
- Define a "Right-Sized" security framework for Arcanys Ventures’ portfolio companies, ensuring they have essential protections without stifling their growth or speed.
- Assist the leadership team during the investment process by evaluating the technical security and data privacy risks of potential new ventures.
- Act as a fractional advisor for our startups, helping their founders establish basic security policies, data privacy compliance (GDPR/DPA), and a "Security by Design" culture from day one.
Originally posted on Himalayas