OCI Security

• We are looking for a senior OCI Security Specialist with 7 to 11 years of experience delivering cloud security architecture, implementation, and operations on Oracle Cloud Infrastructure (OCI).
• The successful candidate will bring strong expertise in cloud security engineering, identity and access governance, data protection, threat detection, and compliance management across OCI and hybrid cloud environments.
• The OCI Security Specialist will design and implement an end-to-end security posture across OCI tenancies, ensuring protection for workloads, data, networks, and identities in alignment with enterprise security policies and regulatory requirements.
• This position demands deep knowledge of OCI security services, security frameworks (CIS, NIST, ISO 27001), and DevSecOps practices.
• You will work closely with cloud architects, network engineers, DevOps teams, compliance officers, and application teams to embed security across every layer of the cloud environment.

Security Architecture & Design:

• Architect and deliver end-to-end security frameworks for OCI tenancies aligned to the CIS OCI Foundations Benchmark, NIST CSF, and ISO 27001.
• Create multi-layer security architectures spanning perimeter security, network security, workload security, data security, and identity security.
• Perform cloud security architecture reviews and threat modeling for OCI-based applications and infrastructure.
• Establish and enforce security baselines, guardrails, and security landing zones for OCI environments.
• Assess and recommend OCI-native and third-party security tools and services. Identity & Access Management (IAM):
• Design and implement OCI IAM policies, Compartments, Groups, Dynamic Groups, and Federation (SAML, SCIM, LDAP) to support enterprise access governance.
• Apply the Principle of Least Privilege (PoLP) and Role-Based Access Control (RBAC) across OCI resources.
• Administer OCI Identity Domains, Multi-Factor Authentication (MFA), and Privileged Access Management (PAM) integrations.
• Run regular IAM access reviews and entitlement certifications.
• Implement service account and API key lifecycle management for OCI resources.

Data Security & Encryption:

• Develop and implement data encryption strategies for data at rest and data in transit across OCI services.
• Manage OCI Vault (Key Management Service) for customer-managed encryption keys (CMEKs), secrets, and certificates.
• Configure OCI Data Safe for Oracle Database security assessment, data masking, and sensitive data discovery.
• Set up and manage encryption for OCI Object Storage, Block Volume encryption, and Database encryption.
• Define and enforce data classification and data handling policies throughout OCI.

Network Security:

• Design and implement network security controls using OCI Network Firewall, Web Application Firewall (WAF), Security Lists, and Network Security Groups (NSGs).
• Configure OCI DDoS protection, rate limiting, and traffic scrubbing for internet-facing workloads.
• Apply Zero Trust Network Access (ZTNA) principles within OCI.
• Monitor and review VCN Flow Logs, Firewall logs, and WAF logs for threat detection and analysis.
• Conduct network security assessments and coordinate penetration testing activities.

Threat Detection, Monitoring & Incident Response:

• Implement and operate OCI Cloud Guard for ongoing security posture monitoring, threat detection, and automated remediation.
• Configure OCI Security Zones and Security Advisor to enforce security policies at the compartment level.
• Integrate OCI Logging, OCI Logging Analytics, and OCI Events with SIEM platforms (Splunk, IBM QRadar, Microsoft Sentinel) for centralized security monitoring.
• Define and manage responses to security incidents, including investigation, containment, eradication, and recovery.
• Create and maintain Incident Response (IR) plans, playbooks, and runbooks for OCI environments.
• Perform ongoing threat hunting and vulnerability management activities.

Vulnerability Management & Compliance:

• Conduct security assessments, vulnerability scans, and CIS benchmark compliance checks across OCI environments.
• Oversee and track remediation of vulnerabilities discovered in OCI workloads and infrastructure.
• Ensure compliance with regulatory requirements including PCI-DSS, HIPAA, GDPR, SOC 2, and ISO 27001 across OCI.
• Use OCI Compliance Documents and perform audit evidence collection for security certifications.
• Implement and manage OCI Audit Service to support robust activity logging and forensic readiness.

DevSecOps & Automation:

• Embed security controls into CI/CD pipelines (shift-left security), including SAST, DAST, SCA, and container image scanning.
• Automate security policy enforcement and compliance checks using Terraform, OCI CLI, and custom Python/Bash scripts.
• Implement OCI Functions to automate security response and remediation.
• Develop security-as-code policies using OPA (Open Policy Agent) or comparable frameworks.
• Manage secure configuration baselines using Ansible and OCI OS Management Service.

Collaboration & Stakeholder Engagement:

• Provide security advisory and guidance to project teams throughout design and implementation phases.
• Deliver security awareness sessions and training for cloud operations and development teams.
• Coordinate with Oracle security teams, third-party auditors, and regulatory bodies as required.
• Mentor junior security engineers and support organization-wide security capability building.
• Produce security reports, dashboards, and executive summaries for leadership and clients.

3. PRIMARY SKILLSETS

OCI Security Services:

• Strong expertise in OCI IAM (Policies, Compartments, Domains, Federation, Dynamic Groups, Service Principals).
• Hands-on experience with OCI Cloud Guard, Security Zones, Security Advisor, and Threat Intelligence.
• Proficiency in OCI Vault (Key Management), OCI Certificates, and OCI Data Safe.
• Solid knowledge of OCI Network Firewall, WAF, VCN Flow Logs, and DDoS Protection.
• Experience with OCI Audit Service, OCI Logging, OCI Logging Analytics, and OCI Events.
• Familiarity with OCI Bastion Service, OCI Web Application Firewall, and OCI Identity Domains.

Cloud Security Fundamentals:

• Strong understanding of cloud security frameworks: CIS OCI Benchmark, NIST CSF, ISO 27001, CSA CCM.
• Expertise in encryption standards (AES-256, TLS 1.2/1.3, RSA, ECC) and PKI management.
• Deep knowledge of IAM fundamentals including RBAC, ABAC, PoLP, PAM, and Zero Trust.
• Experience with threat modeling methodologies (STRIDE, PASTA, DREAD).
• Proficiency in vulnerability management tools (Qualys, Nessus, Rapid7, or equivalent).
• Knowledge of penetration testing concepts and the ability to coordinate with external penetration testing teams.

Security Operations & Compliance:

• Experience with SIEM platforms (Splunk, QRadar, Microsoft Sentinel, or equivalent) for log ingestion and correlation.
• Hands-on experience with Incident Response (IR) processes and security playbook development.

Knowledge of compliance frameworks:

• PCI-DSS, HIPAA, GDPR, SOC 2 Type II, ISO 27001, and DPDP Act.
• Experience with GRC tools and security risk management frameworks.

Automation & Scripting:

• Proficiency in Python, Ansible, Bash scripting for security automation.
• Hands-on experience with Terraform for security infrastructure as code.
• Familiarity with OCI CLI and OCI SDKs for security operations.
• Experience with DevSecOps tooling: SonarQube, Trivy, Checkmarx, Aqua Security, or Prisma Cloud.

4. SECONDARY SKILLSETS

• Experience with Oracle Database Security, including TDE, Database Vault, Label Security, and Audit Vault.
• Knowledge of OCI Data Science and AI/ML security considerations.
• Familiarity with container security and Kubernetes security (OKE RBAC, Pod Security, Network Policies).
• Exposure to CASB (Cloud Access Security Broker) solutions.
• Understanding of OCI Observability and Monitoring for security performance baselines.
• Knowledge of cloud forensics and digital evidence collection techniques.
• Experience with phishing simulation, security awareness, and training program management.
• Familiarity with Oracle CASB Cloud Service and Oracle Security Monitoring and Analytics.
• Understanding of supply chain security and software composition analysis (SCA).
• Knowledge of multi-cloud security architecture (OCI + AWS, OCI + Azure) and cross-cloud governance.
• Exposure to OCI Government Cloud and sovereign cloud security requirements.

5. CERTIFICATIONS

Mandatory / Preferred Certifications:

• Oracle Cloud Infrastructure 2024/25 Security Professional Certification (OCI Security Professional)
• Oracle Cloud Infrastructure 2024/25 Foundations Associate (OCI Foundations Associate)

Additional Preferred Certifications:

• Oracle Cloud Infrastructure 2024/25 Architect Associate / OCI Architect Professional
• Certified Information Systems Security Professional (CISSP) (Highly Preferred)
• Certified Cloud Security Professional (CCSP) - (ISC)2 (Highly Preferred)
• Certified Information Security Manager (CISM) - ISACA - Certified Information Systems Auditor (CISA)
• ISACA (Good to Have) - AWS Certified Security

Specialty (Good to Have Microsoft Certified:

• Azure Security Engineer Associate (Good to Have) - CompTIA Security+ or CompTIA CySA+ - Offensive Security Certified Professional (OSCP) (Good to Have) - Google Professional Cloud Security Engineer (Good to Have)