z/OS UNIX System Services (USS) Security Engineer

Morgan Stanley • Edison, NJ

3d

About The Position

Morgan Stanley is a leading global financial services firm. The Enterprise Z Security team is responsible for engineering and operating IBM Z mainframe authentication and authorization services. This position will be a member of the Enterprise Z Security team and responsible for design, implementation, and monitoring of security controls for z/OS UNIX System Services (USS), ensuring that USS identity and permissions are properly integrated with mainframe security controls (RACF / Top Secret) and aligned to least privilege, auditability, and operational resilience. The USS Security Engineer is responsible for securing and administering z/OS UNIX System Services (USS) environments on the mainframe. This role focuses on enforcing least privilege, protecting privileged access, and ensuring alignment between UNIX permissions, ESM controls (RACF/TSS), and enterprise security standards. The engineer will partner closely with the Enterprise Z security architect, system programmers, middleware teams, and audit/compliance stakeholders to maintain a secure and compliant USS platform.

Requirements

• Bachelor's degree and 5+ years of experience with mainframe and z/OS UNIX System Services.
• Strong hands-on experience securing USS environments.
• Proven experience administering RACF or equivalent ESM for USS.
• Solid understanding of: UIDs, GIDs, OMVS segments, and service IDs
• POSIX permissions, ownership, and execution controls
• Experience with USS related security controls, including: UNIXPRIV class, FACILITY class resources impacting OMVS, STARTED task identities for USS services
• Working knowledge of zFS/HFS file systems, mount options, and USS SMF/audit logging.
• Strong understanding of least privilege and separation of duties principles.

Nice To Haves

• Experience with PKI, digital certificates, Kerberos, SSL/TLS, SSH, or OpenSSL.
• Exposure to systems programming concepts (e.g., SMP/E, SYS1 datasets, Assembler).
• Understanding of mainframe networking concepts.
• Experience supporting or securing middleware technologies (e.g., MQ).

Responsibilities

• Administer and manage USS identities, including UIDs, GIDs, OMVS segments, and service/shared IDs based on policy.
• Enforce naming standards, ownership traceability, and lifecycle controls for USS users and services.
• Manage and audit POSIX permissions, ownership, and execution rights across critical USS file systems.
• Control and monitor privileged access, including UID(0), setuid/setgid programs, and elevated authorities.
• Administer USS related ESM controls (RACF/TSS), including UNIXPRIV, FACILITY resources, and STARTED task identities.
• Secure USS configuration files, shell environments, PATH settings, and file system mount options.
• Monitor USS security events, logs, and audit records.
• Support production issues, security incidents, and access related investigations.
• Develop and maintain USS security standards, procedures, and documentation.

Benefits

• Ample opportunity to move about the business for those who show passion and grit in their work.
• Attractive and comprehensive employee benefits and perks in the industry.

What This Job Offers

• Job Type: Full-time
• Career Level: Senior