- Define and maintain the information security strategy, standards, and roadmap aligned to regulations and best practices.
- Steer security architecture across a cloud-native environment, defining secure-by-design patterns for microservices, APIs, and shared services.
- Establish and govern secure SDLC practices, embedding automated security controls into CI/CD pipelines.
- Build and run security monitoring, logging, and threat detection across cloud, infrastructure, and application layers.
- Lead the security incident response lifecycle and act as incident commander for security events.
- Own vulnerability and threat management including scanning, prioritization, and remediation tracking.
- Govern identity and access management, privileged access, and least-privilege principles across cloud and corporate systems.
- Implement and evidence the technical security controls underpinning PCI DSS, ISO 27001, and SOC audits.
AWSCI/CDDevOps+2 more