Cloud Security Architect
About Toptal
Toptal is a global network of top freelance talent in business, design, and technology that enables companies to scale their teams, on-demand. With $200+ million in annual revenue and over 40% year-over-year growth, Toptal is the world’s largest fully remote company.
We take the best elements of virtual teams and combine them with a support structure that encourages innovation, social interaction, and fun. We see no borders, move at a fast pace, and are never afraid to break the mold.
Position Description
As a Cloud Security Architect at Toptal, you will be in charge of identifying Toptal’s main attack vectors, provide and lead a strategy to mitigate those risks. You will work with Development teams, Security Operations, IT Operations, Infrastructure teams and Risk and Compliance to provide the tools, environment, and guidance for building high-quality secure applications. You will contribute to software design and implementation decisions. You will build libraries and utilities to help developers to keep our software secure. You will conduct assessments, automate operational workflows, and hold security training.
Responsibilities:
- Identify and maintain a list of attack vectors.
- Build strategies and lead the change to mitigate the security risks from an integral perspective.
- Create and improve engineering Disaster Recovery strategy.
- Build the opportunity assessments, and collaborate with the security team to set the priorities.
- Provide timely and adequate information about the current state of Toptal security.
- Develop corporate security practices, policies, and standards.
- Respond to any ongoing or completed incidents, help the teams to find the root cause, and set any possible action point.
- Contribute to the creation of application designs and solutions and assist with code reviews.
- Educate the staff on personal, corporate, architecture, and development security best practices.
- Raise security concerns to the forefront.
In the first week, expect to:
- Onboard and integrate into Toptal.
- Rapidly begin learning about Toptal’s history, culture, and vision.
In the first month, expect to:
- Get familiar with the tools we use to assess and improve the security of our applications.
- Complete necessary training.
- Have one on ones with all the relevant security people.
- Begin collaborating with other teams.
In the first three months, expect to:
- Identify major security risks.
- Improve the security audit of our applications (integrate new security tools, scale current solutions to more projects, create dashboards with metrics, and set up automated notifications for our teams).
- Begin studying for a security-related certification following the team’s guidelines.
- Work on achieving team OKRs.
In the first six months, expect to:
- Build a security strategy focused around engineering.
- Take part in making design/implementation decisions.
- Provide support during security events and carry on follow-up actions.
- Suggest and implement improvements to our processes and tools.
- Hold security awareness & education sessions and develop appropriate materials for the whole company.
In the first year, expect to:
- Assist in preparation for certification against one of the modern security standards (ISO 27001, SOC1, or other).
- Get certified in the item of your choice.
Requirements:
- Outstanding communication skills.
- Great vision and strategy for security.
- Experience working with Agile methodologies.
- Experience with change management within an organization.
- 5+ years of experience with application security.
- Experience in application development with at least 1 modern programming language.
- Infrastructure and network experience.
- Experience with automation and Continuous integration tools.
- Experience securing cloud platforms (preferably GCP).
- Experience with threat analysis and red team.
- Knowledge of OWASP methodology and web and mobile vulnerabilities.
- Be familiar with common security standards (e.g. ISO/IEC 27000-series, GDPR, SOC1).
- Be familiar with SAST and DAST tools like BurpSuite, OWASP ZAP, NMap, Metasploit, Kali Linux, etc.
- Be familiar with SIEM or IPS and IDS tools.
- Ability to solve complex problems by considering multiple solutions, weighing them, and deciding on the best course of action.
- Be genuinely interested in technology and love to try new things.
- Be open to receiving constructive feedback.
- Be a team player at heart.
