Cloud Security Engineer

Bank OZK•Little Rock, AR

12d

About The Position

Responsible for ensuring the secure design, implementation, and operation of Bank OZK’s cloud environments. The Cloud Security Engineer works closely with IT, Labs, Data teams, Third-Party Risk Management, and application owners to implement cloud security controls and enforce compliance with Bank policies and industry regulations.

Requirements

Bachelor’s degree in Information Systems or related field; or commensurate work experience, required.
Three (3) years’ work experience in a regulated financial institution or other heavily regulated environment, required.
Familiarity with banking-specific security considerations and third-party risk management practices for cloud services, required.
Knowledge of integrating security testing tools into build/deployment pipelines and managing secrets for automation.
Ability to work with DevOps/CI-CD pipelines and using Infrastructure-as-Code (Terraform, CloudFormation, etc.) in a secure manner.
Advanced security-minded with the ability to assess risk in cloud architectures.
Ability to consistently apply principles of confidentiality, integrity, and availability when evaluating cloud solutions and making risk-based decisions aligned with the Bank’s risk appetite.
Strong diligence in configuring and reviewing cloud settings, logs, and processes to ensure nothing is overlooked. Vigilant in following through on issues until they are fully resolved and verified.
Strong critical thinking skills to analyze complex technical problems or security events in cloud environments.
Ability to break down problems, identify patterns or root causes, and develop effective solutions or mitigations.
Ability to effectively communicate technical cloud security issues into business impact terms.
Excellent interpersonal skills with an ability to work collaboratively on cross-functional teams, clearly articulate recommendations, and influence secure outcomes without formal authority.
Ability to work in a fast-paced, evolving environment. Able to adjust to new cloud services, threats, and regulatory requirements as they emerge, updating strategies and tactics accordingly.
Ability to be self-motivated and proactive. Takes ownership of projects and problems; drives improvements in cloud security practices without waiting for direction. Demonstrates a strong sense of responsibility and ethics, especially important in handling sensitive systems and data.
Ability to demonstrate initiative to accomplish work objectives.

Nice To Haves

Professional security certifications related to cloud and information security (e.g., CCSP, CISSP, AWS/Azure Security Engineer, or CompTIA Security+), preferred.

Responsibilities

Supports the onboarding and risk assessment of new Cloud Service Providers (CSPs) through the Third-Party Risk Management (TPRM) process.
Evaluates CSP security controls against Bank OZK’s Cloud Security Standard and regulatory requirements, ensuring that proposed cloud solutions meet all legal and compliance criteria before approval.
Implements and maintains cloud security controls across SaaS, PaaS, and IaaS environments, applying Bank-approved secure configuration baselines (leveraging industry benchmarks like CIS) for cloud resources (VMs, containers, storage, etc.) and enforces “secure-by-default” settings during deployments.
Collaborates with OZK Technology teams to design cloud architectures that incorporate network segmentation, encryption, and other security best practices from start to completion.
Integrates cloud platforms and applications with the Bank’s centralized Single Sign-On (SSO) and identity management systems.
Ensures that cloud activity logs are enabled, collected, and integrated with Bank OZK’s Security Information and Event Management (SIEM) and monitoring systems.
Develop detections or alert rules to monitor cloud events for signs of compromise or policy violations.
Investigates and responds to cloud security incidents in coordination with the Security Operations Center (SOC), helping to remediate issues and implement lessons learned.
Manages cloud environments for security compliance and misconfigurations using automated Cloud Security Posture Management (CSPM) tools or scripts.
Performs configuration audits and vulnerability scans of cloud assets and works with infrastructure and application teams to remediate identified weaknesses or document risk acceptances according to the Bank’s vulnerability management standards.
Collaborates with software development teams and Application Security Engineers on secure deployment of cloud-native applications. Ensures cloud-hosted applications follow secure coding and deployment practices aligned with Bank standards (e.g. perform threat modeling, enforce secure SDLC requirements).
Implements cloud-native application security controls such as web application firewalls (WAFs) for internet-facing apps and ensure proper network restrictions (security groups, private endpoints) for sensitive data stores
Embeds security into the CI/CD pipeline and infrastructure-as-code processes. Works with DevOps engineers to implement automated security checks for cloud infrastructure templates and application code (e.g. IaC scanning, container image scanning, secret leakage detection).
Advises on secure configuration of CI/CD tools and use of secure secret management for pipeline credentials. Promote DevSecOps best practices so that security is an integral part of cloud deployment workflows.
Provides guidance and training to IT cloud engineers, developers, and business units on cloud security requirements and secure cloud service usage.
Ensures that cloud security controls and processes are well-documented and ready for audits or examinations.
Provides evidence of compliance with the Bank’s Cloud Security Standard and applicable regulations during audits (internal, external, or regulatory). Address audit findings or recommendations related to cloud security by implementing corrective actions or process improvements.
Stays current with relevant regulatory guidelines (e.g. FFIEC cloud computing guidance, NYDFS cybersecurity requirements).
Stays informed on evolving cloud security threats, tools, and best practices, especially as they relate to financial institutions.
Proactively recommend and implement enhancements to Bank OZK’s cloud security posture.
Performs or assigns other tasks and assists other team members as necessary.