安全专家
Security Subject Matter Expert
职位名称：安全专家
简介：
我们正在寻找一位经验丰富的安全专家，负责领导和参与 MasrPay 金融科技应用的信息安全计划。该职位在保护敏感数据、保持合规性以及确保系统完整性和机密性方面至关重要。
职位概述：
安全专家将负责设计、实施和管理我们基础设施上的安全设计/解决方案和协议，并领导 MasrPay 的安全合规计划。这包括利用安全工具如 IPS/IDS、SIEM、FIM 和 WAF 解决方案，以及建立加密和数据保护实践，遵循 PCI DSS 要求及相关法规如 GDPR，以及安全标准和框架如 ISO27000、NIST-800和 CSF。该职位需要与应用开发和 DevOps、安全和网络团队紧密合作，以确保安全在开发生命周期的每个阶段得到集成。
职责：
- 开发、实施和维护安全设计/解决方案和协议，以保护敏感数据和应用程序。
- 精通 IPS/IDS、SIEM、FIM、FW 和 WAF，并具备实际操作技能。
- 进行安全评估、漏洞分析和渗透测试，以识别风险。
- 与开发人员协作，将安全最佳实践整合到开发和部署过程中。
- 确保符合行业标准，如 PCI-DSS，以及其他相关法规，如 GDPR、ISO27001，将是加分项。
- 在所有层级上管理加密和数据保护策略。
- 响应并调查安全事件，提供根本原因分析、修复和缓解策略。
- 跟踪最新的安全趋势、漏洞和法规要求。
- 资格要求：
- 计算机科学、信息安全、信息技术或相关领域的学士学位。
- 5年以上网络安全和安全合规要求经验，如 PCI-DSS，最好在金融科技或金融行业。
- 精通安全解决方案，包括 IPS/IDS、SIEM、FIM、FW、WAF 和加密技术。
- 具备安全评估工具和方法的经验，包括漏洞扫描和渗透测试。
- 熟悉 SDLC、CI/CD 流水线、DevOps 和 DevSecOps。
查看英文原文
Job Title: Security Subject Matter Expert
Introduction:
We are looking for an experienced Security Subject Matter Expert to lead and contribute to MasrPay information security program for our fintech applications. This role is essential in safeguarding sensitive data, maintaining regulatory compliance, and ensuring the integrity and confidentiality of our systems.
Role Overview:
The Security Subject Matter Expert will be responsible for designing, implementing, and managing secure designs/solutions and protocols across our infrastructure, and leading MasrPay security compliance program. This includes leveraging security tools such as IPS/IDS, SIEM, FIM, and WAF solutions, as well as establishing encryption and data protection practices, following PCI DSS requirements, and relevant regulations like GDPR, and security standards and frameworks like ISO27000, NIST-800 and CSF. The role requires close collaboration with application development and DevOps, security and network teams to ensure that security is integrated into every phase of the development lifecycle.
Responsibilities:
- Develop, implement, and maintain secure design/solutions and protocols to protect sensitive data and applications.
- Strong knowledge and hands-on skills with IPS/IDS, SIEM, FIM, FWs and WAF.
- Conduct security assessments, vulnerability analysis, and penetration testing to identify risks.
- Collaborate with developers to integrate security best practices into the development and deployment processes.
- Ensure compliance with industry standards, such as PCI-DSS, and any other relevant regulations will be an added asset. e.g. GDPR, ISO27001.
- Manage encryption and data protection strategies across all tiers.
- Respond to and investigate security incidents, providing root cause analysis, remediation and mitigation strategies.
- Stay up-to-date with the latest security trends, vulnerabilities, and regulatory requirements.
Qualifications:
- Bachelors degree in Cybersecurity, Computer Science, Information Technology, or related field.
- 5+ years of experience in cybersecurity and security compliance requirement, such as PCI-DSS, preferably within fintech or financial industries.
- Strong knowledge of security solutions, including IPS/IDS, SIEM, FIM, FW, WAF, and encryption techniques.
- Experience with security assessment tools and methodologies, including vulnerability scanning and penetration testing.
- String knowledge with SDLC, CI/CD pipelines, DevOps, and DevSecOps practices.
Preferred Skills:
- Relevant certifications (e.g., CISSP, CEH, CISM, or GIAC).
- Familiarity with compliance requirements, such as PCI-DSS, SOC2, and GDPR.
- Knowledge of Kubernetes, Docker, and cloud security best practices.
- Experience with Unix platforms, Kafka, Keycloak, and data encryption in distributed systems.
- Strong analytical and problem-solving skills for incident response and forensic analysis.
Originally posted on Himalayas