This team drives the response and management of cyber incidents, using an intelligence-led approach for identification, mitigation, and rapid response to safeguard bp on a global scale. By applying lessons learned and data analytics, they establish engineering principles and enhance the technology stack to continuously bolster bps cybersecurity posture.
About the role
We are looking for Information Security Engineering Specialist (Application and Offensive security) who will be accountable for supporting the management of large security data sets, developing data-driven solutions and insights, and building data integration solutions and digital automation. We build digital solutions primarily in the cloud using Azure and AWS, so we can adapt quickly, demonstrate the latest technology, and scale our solutions globally.
You will advocate that application development, platform development, and infrastructure teams adhere to secure design and development practices (e.g., threat modeling, technical design review, resilience testing, monitoring alerting, code review, and documentation)
You will also contribute to standard processes that will help shape bp s security agenda and create a culture of excellence.
What you will deliver
Provide technical expertise in support of information security and risk activities specific to the specialism to achieve objectives e.g. designing and developing security solutions to work across bp s digital environments that are consistent with current policies.
As appropriate, provide support to investigations and incident response processes, providing a consistent response to cyber-based malicious activity.
Deliver the implementation and application of relevant operating processes and procedures, and ensure all activities adhere to the relevant standards.
Evolve the security roadmap to meet anticipated future requirements and needs.
Create and articulate materials on how to embed and measure security throughout the software and platform development lifecycle.
Develop and maintain a series of internal and external collaborator relationships, delivering advanced technical knowledge to support project delivery, cooperatively identify key challenges and ensure that security solutions successfully protect bp against cyber risks.
Build awareness relevant technology developments, managing the delivery of process and system improvements, identifying and implementing continuous improvement plans for the specialism and ensuring proven, optimal approaches are shared across the team.
Actively sponsor and mentor emerging talent and promote a culture of continuous development; and provide informal mentoring/training to junior team members.
What you will need to be successful (experience and qualifications)
Seasoned security professional with 3+ years delivering security engineering services and/or building security solutions within a complex organization.
Practical experience designing, planning, productizing, maintaining and documenting reliable and scalable data infrastructure, cloud and data products in complex environments.
Firm foundation of information and cyber security principles and standard processes.
Professional and technical security certifications such as CISSP, CISM, GEVA, CEH, OSCP or equivalent are a plus.
Development experience in one or more object-oriented programming languages (e.g., Python, Scala, Java, C#) and/or cloud environments (including AWS, Azure, Alibaba, etc.)
Strong knowledge and implementation experience in technologies across all data lifecycle stages.
Experience with two or more of the following security technologies/areas: Security Information and Event Management (SIEM), Intrusion Prevention or Detection System (IPS/IDS), Email Security Gateways, Web Security Gateways, Multi-Factor Authentication (MFA) Systems (MFA), Endpoint Protection, Endpoint Detection and Response (EDR), Security Orchestration Automation and Response (SOAR), Firewalls, Vulnerability Scanners
Operational proficiency in frameworks such as CIS CSC, NIST CSF, NIST 800-53, ISO 27001, etc.
Foundational knowledge of security standards, industry laws, and regulations such as Payment Card Industry Data Security Standards (PCI-DSS), General Data Protection Regulation (GDPR), California Consumer Privacy Act (CCPA) and Sarbanes-Oxley (SOX)