[Hiring] Senior DevSecOps Engineer @ORCID

ORCID is seeking a Senior DevSecOps Engineer to serve as an technical advisor and implementor to ensure the ongoing security of ORCID products and service offerings. The Senior DevSecOps Engineer reports directly to the Director of Technology but is also functionally accountable to the Director of Operations and the Director of Product as seamless, matrixed partnership across ORCID units will be key to the success of this role. 

This position is full time (40 hours/week) and, like all positions at ORCID, is fully remote. Candidates must be able to work during Europe or Americas standard business hours (Mon-Fri) with at least four hours daily between 1300-2000 UTC, with some recurring meetings between 1400 - 1700 UTC. Outside of these parameters, ORCID offers flexibility with your schedule.

Responsibilities

• Work with ORCID senior staff, product, technology, and devops teams to identify the right architecture to ensure the secure  implementation of new solutions, products and modules. 
• Develop, implement and maintain product security strategy for the ORCID product portfolio
• Conduct complete lifecycle security architecture and technical assessments for a wide range of product infrastructure, databases, web applications, and internal/SaaS software solutions.
• Identify and work with the ORCID product and technology teams to mitigate security risks in the product and infrastructure.
• Collaborate with the product and technology teams to ensure security best practices are integrated into the development lifecycle (SDLC) to reinforce “security by design” concepts.
• Provide guidance and leadership on best practices regarding security in software and product development.
• Analyse and prioritise vulnerabilities identified by developers, customers, testers, as well as automated static and dynamic application security testing. Work closely with developers to remediate in alignment with the identified risk to ORCID systems, users, and data.
• Implement or guide the implementation of common application security controls
• Ensure privacy requirements are implemented through data protection and security technology both within ORCID products and internal/SaaS tools.
• Work with the ORCID operations team on the selection and secure configuration of internal/SaaS tools.
• Identify and work with the ORCID operations team to mitigate security risks in internal and SaaS tools.
• Provide training and education to developers on software security best practices.
• Participate in the on call rotation for out of hours support, and respond to extraordinary situations or technical emergencies

Requirements and Qualifications 

Required Skills:

• Proven experience as a DevSecOps engineer or similar role involving securing a user-facing product. (4-6 years)
• Experience translating OWASP Top 10 into practical development imperatives and applying to product infrastructure (4-6 years)
• Knowledge of and experience with best practices in the union of security engineering and DevOps (2-3 years)
• Experience with cloud services (e.g. AWS), their native services, and security features. (3-4 years)
• Experience securing databases including access control and encryption whilst maintaining performance (2-3 years)
• Experience with integration and release pipelines and the security of tools such as GitHub Actions or other similar modern CI platform (2-3 years)
• Familiarity with the security of containerisation technologies such as Docker and Kubernetes. (2-3 years)
• Knowledge of Terraform, network security architectures, network access controls, and secure network design. (2-3 years)

• Strong problem-solving skills
• Ability to work well in teams and across the organisation.
• Self-starter. Ability to define the problem at hand, recommend solutions, and drive to results
• Strong communication skills, with the ability to explain complex concepts to colleagues across an entire range of technical capabilities from non-technical to highly-technical.

• Fluency in English required. Additional languages a plus.
• Ability to travel based upon business needs (less than 10%)

Nice to have:

• Previous experience in enterprise security tools
• Proficiency with securing and addressing security issues within programming languages such as Python or Java. (3-4 years) Previous experience as a practising developer is an additional plus.

To Apply: Please submit your CV and a cover letter in Bamboo. In your cover letter, outline how your experience aligns with the roles and responsibilities of this position. ORCID encourages applicants who meet some, but not all of the requirements and qualifications, to apply.

Our Culture

ORCID has been a global, 100% remote organization since our founding in 2012. This has enabled us to build a team of the best and brightest minds in the industry. ORCID staff are curious and collaborative, and we strive to maintain a culture of learning. We offer programs like individually-focused professional development planning, monthly “Food for Thought” learning sessions on a wide variety of topics, and access to a digital learning platform, Udemy for Business. We are flexible and family-friendly, allowing staff to shift their schedules as needed, flex their time across the calendar month, and take an hour-long paid break each day (not to mention OFF– see the benefits we provide below). 

As an organization, we are committed to diversity, equity and inclusion (DEI). We invite you to read our DEI statement and principles as well as learn about internal and external DEI initiatives we support here. As a fully remote organization, we also have an active committee dedicated to making our individual remote experiences as positive and productive as possible. Read more about our culture here.

Although we are geographically diverse, we are a small, cohesive community dedicated to our mission and to each other

As an open organization valuing trust and transparency, we have a privacy policy describing how we handle applicant, employee and contractor data that we invite you to review if interested.

We provide:

A family-friendly, flexible working environment, including: 

• Flexible work hours and the ability to work fully from home (when not traveling)
• A committed and awesome team serving a community-driven organization
• Competitive compensation & benefits, including a generous annual leave allowance, leave for Family & Compassionate Care, and an ORCID-wide closure (day off) the Fourth Friday of each month
• A continuous learning environment with opportunities for training & professional development
• Tools to support our virtual office environment, including a budget to choose your preferred laptop and a monthly remote working stipend.
• An annual in-person all staff retreat plus optional virtual social events throughout the year.
  
  

Compensation

ORCID’s compensation strategy considers an applicant’s skills and experience, geographic location, as well as internal equity when assessing salary. Because we are remote and hire all over the globe, our salary ranges will vary by location for any given role.