Cloud Security Expert - Product Security
Via agency · Cavendish Professionals
Cybersecurity specialistBudapest
Cavendish Professionals are currently looking to speak to Product Security Experts to join our clients' dynamic team and help build secure, resilient systems. Based in Budapest, this role is being offered on a hybrid basis. The successful candidate will have proven experience in software security, DevSecOps or application security engineering with a strong understanding of cloud-native development, security tools and methodologies, and secure operational practices.
Tasks
- Conduct security and risk assessments across applications and systems to identify vulnerabilities.
- Collaborate with security colleagues to establish Frontier AI scanning capability, analyse technical findings, manage backlogs and improve the security posture.
- Create, manage and resolve Jira backlogs for security issues, exceptions and risk items.
- Support the rollout and implementation of SDLC, including documentation, exception handling and compliance alignment.
- Work with development and operations teams to integrate security into CI/CD pipelines, including SAST, DAST, dependency scanning and compliance-as-code.
- Help develop and maintain security policies, standards and procedures aligned with ISO 27001, SOC 2 and PCI-DSS.
- Configure and optimise security tools and vulnerability scanners to improve detection and efficiency.
- Co-lead threat modelling and risk assessment workshops to evaluate architectural and operational risks.
- Provide clear documentation and explain complex security concepts to stakeholders.
- Collaborate with architects, service owners and SAP Global Security & Compliance contacts to create security concepts for critical projects.
Requirements
- Expertise with security tools and methodologies, including SAST, DAST and vulnerability scanners (Tenable/Nessus, Rapid7, Aquasec/Trivy, Black Duck, CheckMarx, Fortify, Coverity etc)
- Experience with SIEM systems such as Splunk or Elastic, and comfortable using Jira or similar ticketing systems.
- Strong understanding of compliance standards, including ISO 27001, SOC 2 and PCI-DSS.
- Experience moderating Threat Modelling workshops and familiarity with STRIDE.
- Deep knowledge of cloud-native development (Exposure to major providers -- AWS, Azure, GCP), containers and Kubernetes, and development experience in JavaScript, Python and/or Golang
- Familiarity with physical datacenter infrastructure, including storage, network and hypervisors such as KVM, is advantageous.