ELEVATE is seeking an experienced IT Infrastructure and Information Security Lead. This is a vital role in leading ELEVATE’s posture around IT Security and infrastructure / DevOps management covering such aspects as Information Risk Management (IRM), Cybersecurity Incident and impact assessment, understanding these risks in context of the IT control environments and covering all related applications and platforms. This role will evaluate and establish scalable infrastructure and appropriate security controls for ELEVATE’s enterprise applications which will transform the way brands and retailers assess their supply chains and drive improvements.
- Develop technical requirements, policies, procedures and controls for network, system and data security
- Provide technical guidance to application teams and implement the necessary security configurations related to the infrastructure and applications
- Define appropriate framework for cybersecurity monitoring and implement cybersecurity control mechanisms which are consistent with ELEVATE strategy
- Manage end-to-end project management from initiation to deployment and rollout as well as post-implementation on Information Security including establishment of policies, the deployment of Security Controls & Framework, DevSecOps best practices, etc.
- Manage information system security operations, including executing and reporting on security operations performance
- Implement general IT risk and control mechanism such as access controls, and IT operations controls
- Detect, identify and monitor security vulnerabilities and make recommendations on remediation actions
- Act as a focal point for internal/external audit around technology risk and information security matters
- Lead IT projects that cover IT Infrastructure and IT Security and establish specifications, functional requirements, test plan, and use cases, etc. for the same
- Manage and oversee the Office 365 platform from a security policy and security controls perspective.
IT Infrastructure Management
- Manage and oversee multi-region, redundant and performant infrastructure solutions for the breadth of our applications leveraging cloud hosting service providers such as AWS and GCP
- Design and deliver effective engineering solutions and automated processes to address operational goals centered around hosting, data storage, and application availability.
- Partner with Software Engineering, Quality Assurance (QA), and Technical Operations (TechOps) in an operational capacity to maintain continuous delivery and availability of mission critical systems.
- Be responsible for the hardening, resiliency and security of all our network and infrastructure
- Lead and administer the security and usability aspects related to ELEVATE’s Office 365 solution
- Develop and establish the enterprise solutions on Active Directory, VPN and centralized management of all client assets (laptops/mobiles)
- Profile server, cloud resources, and applications to identify and resolve performance issues
- Interface directly with Technical Architect and Software Engineering to architect efficient and effective solutions.
- Be responsible for the hardening, resiliency and security of all of our network and infrastructure
- Monitor and respond to system issue and participate in 24x7 on-call rotation.
- Other duties as assigned.
Requirement and Qualifications
- At least 10 years working experience on IT infrastructure, Information Security such as Application Security, security architecture and DevOps
- Knowledge of enterprise infrastructure, AD, Group Policy, Office 365, Identity and Access Management, Windows, Linux, VMware, cloud services such as AWS and GCP.
- Knowledge of infrastructure automation through DevOps tools and scripting knowledge
- Able to cover and manage docker/containers, Continuous Integration/Continuous Deployment
- Experience in designing, executing and supporting central IT infrastructure, and Cloud solutions
- Strong understanding of Application Design including web, mobile and backend platforms, DevOps, APIs (JSON/REST/SOAP), Database, Cloud Security, Infra as Code (IaC), TCP/IP, system and network fundamentals.
- Experience with at least one programming language, preferably NodeJS, Bash, Python, Ruby
- Experience with Atlassian suite of tools: JIRA, Confluence, BitBucket
- Working knowledge of using configuration management systems, such as Chef, Puppet, Salt, DSC, Ansible, Docker, Etckeeper.
- Experience in configuring and administering Amazon Web Services (VPC, EC2, ELB, and RDS, Virtual Networking Topologies, PowerShell/DSC, BASH, PHP, Windows, SQL Server (deployment and monitoring), Linux, RDP, and more)
- Experience implementing and using Continuous Integration and Continuous Delivery concepts and tools such as Github, Jenkins, TeamCity, Octopus, Maven, CodeDeploy or comparable tools.
- Understanding of system monitoring and application logging solutions (SumoLogic, New Relic, Nagios, Graphite, Grafana, Logstash, InfluxDB, Solarwinds)
- Knowledge of common information security management frameworks, including but not limited to: ISF, ISO 27000, ITIL, COBIT and NIST is desired.
- Professional security management certification, such as a CISSP, CISM, CEH is desired
- Professional certification on Penetration Testing such as OSCP/E, GWAPT, GPEN, or GXPN certification(s) or other similar credentials will be an added advantage.
- Holder of professional qualification(s) any of Project Management, Security, Cloud, Linux, MS or Virtualization certifications is advantageous
- Good problem-solving skill for handling system operations issue
- Strong written and oral communication skills including the ability to communicate complex issues to technical and non-technical staff and management.
- Good leadership and communication skills, team player with multi-tasking capabilities and able to meet tight deadline
- Highly motivated team player with excellent analytical, written, verbal communications and presentation skills is required.