Information Security Officer
信息安全官维护运营系统，网络和安全 · 促进年度 PCI 审计并确保持续的合规性。· 确保 Linux 系统快速和安全地进行补丁，如果预期客户影响，通过正确的变化控制过程协调。· 维护和监测 Elastic SIEM,响应警报，并执行深入调查。· 在所有技术堆中解决问题，包括生产/QA 环境，数据库，网络和集成。·部署和管理工具以提高操作，安全和效率。· 研发和实施新工具 （开源或商业）,以提高系统性能，监控，记录，安全性或合规性。·开发 Python 脚本和工具来自动化重复任务。AWS 云基础设施 · 安全构建和管理 AWS 服务，包括但不限于：· VPC,EC2,ECS/Fargate,ECR · GuardDuty,CloudWatch,CloudTrail ·负载平衡器，VPN 和 WAFs ·保持第三方，银行合作伙伴以及本地数据中心之间的强大的连接。·执行并执行系统隔离，范围减少和安全方面的最佳实践。硬件安全模块 (HSM). · 支持现场工程师，维护内部 HSM (Futurex,Thales). · 开展关键管理仪式并保持 PCI 的合规性。安全治理和遵守。· 协助包括：· PCI-DSS & PCI+PIN · ISO 27001 （延伸目标）· GDPR · 维护基础设施，程序和安全政策的准确和最新文档。· 促进公司内的安全意识文化。自动化与效率 · 实施自动化以增强基础设施和安全管理。· 在维持高安全和性能标准时优化成本。安全监测和报告 · 确保每周在 SLA 内完成，跟踪和解决漏洞扫描。· 每天/每周进行 PCI 正常业务活动的审查和签署。· 月度分析数据并报告安全指标。·与第三方合作完成和通过 PCI 认证审计。· 对公司对外部伙伴的安全承诺进行评估和履行。
查看英文原文
Information Security Officer
Maintain Operational Systems, Networks and Security
- Facilitate annual PCI audits and ensure ongoing compliance.
- Ensure Linux systems are patched promptly and securely, coordinating through the correct change control process if customer impact is anticipated.
- Maintain and monitor Elastic SIEM, respond to alerts, and perform in-depth investigations.
- Troubleshoot system issues across all technology stacks including production/QA environments, databases, networks, and integrations.
- Deploy and manage tooling to enhance operations, security, and efficiency.
- Research and implement new tools (open source or commercial) that improve system performance, monitoring, logging, security, or compliance.
- Develop Python scripts and tools to automate repetitive tasks.
AWS Cloud Infrastructure
- Securely architect and manage AWS services, including but not limited to:
- VPC, EC2, ECS/Fargate, ECR
- GuardDuty, CloudWatch, CloudTrail
- Load balancers, VPNs, and WAFs
- Maintain robust connectivity between third parties, banking partners, and on-premises data centres.
- Implement and enforce best practices in system isolation, scope reduction, and security.
Hardware Security Modules (HSM)
- Support field engineers and maintain internal HSMs (Futurex, Thales).
- Conduct key management ceremonies and maintain PCI compliance.
Security Governance & Compliance
- Assist with audits and regulatory requirements including:
- PCI-DSS & PCI+PIN
- ISO 27001 (Stretch goal)
- GDPR
- Maintain accurate and current documentation of infrastructure, procedures, and security policies.
- Promote a security-aware culture within the company.
Automation & Efficiency
- Implement automation to enhance both infrastructure and security management.
- Optimise costs while maintaining high security and performance standards.
Security Monitoring & Reporting
- Ensure weekly vulnerability scans are completed, tracked, and resolved within SLA.
- Review and sign off on daily/weekly PCI business-as-usual activities.
- Analyse data and report security metrics monthly.
- Collaborate with 3rd parties to complete and pass PCI certification audits.
- Review and uphold The Companys security commitments to external partners.
What Were Looking For
Qualifications & Experience
- Bachelors degree in Computer Science, Information Security, or related field.
- At least 3 years relevant experience in security or infrastructure roles.
- Experience in the payments or banking sector preferred.
- Familiarity with PCI audits, DevOps practices, Linux, MySQL, and AWS.
Skills & Knowledge
- Strong understanding of PCI-DSS requirements and security standards.
- Hands-on experience with:
- Linux (security patching, system administration)
- MySQL
- AWS services and virtual networking (VPC, ALB/NLB, WAF, VPNs, etc.)
- Automation tools: CloudFormation, Ansible, Puppet, Chef
- CI/CD: Bitbucket Pipelines, Jenkins
- Scripting: Bash, Python
- Containers: Docker, Kubernetes, ECS
- Monitoring: Zabbix, Nagios
- Logging & SIEM: ELK Stack, CloudWatch, Elastic, Splunk
Originally posted on Himalayas