Security Engineer 3

The Oracle Cloud Infrastructure (OCI) team can provide you the opportunity to build and operate a suite of massive scale, integrated cloud services in a broadly distributed, multi-tenant cloud environment. OCI is committed to providing the best in cloud products that meet the needs of our customers who are tackling some of the world’s biggest challenges.

We offer unique opportunities for smart, hands-on security engineers with the expertise and passion to solve difficult problems in distributed highly available services and virtual infrastructure. At every level, our engineers have a significant technical and business impact designing and building innovative new systems to power our customer’s business critical applications. Our customers run their businesses on our cloud, and our mission is to provide them with the most secure cloud services.

The OCI Hardware Security group conducts Security assessments of the production hardware that runs our cloud, and develops the requirements for future Networking, Storage, Compute components. We work closely across Oracle, with third party vendors, and with standards organization to influence the next generation of hardware platform security. In addition to defining the best hardware, OCI HW Security knows that platform security also depends on how that hardware is used. To that end, HW Security also works closely with OCI's operations and engineering teams, constantly striving to improve Oracle Cloud's overall operational security posture by defining the supply chain and operational requirements to establish best practices for managing security for every device in our data centers.

A security-focused engineer at any level can have significant technical and business impact. Come shape the future of one of the largest clouds on earth with us. Overall, the OCI Security Architecture team performs a variety of work ranging from cloud security, application security, vulnerability analysis, threat modeling, and hacking/enterprise network penetration.

The biggest challenges for the team is the dynamic and fast growth of the business, driving us to improve our systems, tools, and automation to scale to our security expertise several orders of magnitude greater than what we can support today. We understand that software is living and needs investment. The challenge is making the right tradeoffs, communicating those decisions effectively, and crisp execution.

Candidates should have

• Bachelor's degree in Electrical Engineering, Computer Science or related field or equivalent experience
• 5+ years of experience in hardware security architecture / engineering / validation / planning or related area
• Demonstrated competency in application/product/software/hardware security
• Must possess expertise in
  • Systems/embedded programming or reverse engineering (c/c++ preferred, x86/ARM programming would be a bonus)
  • Strong linux foundations including but not limited to systems programming, scripting, ability to modify kernel and build forks
  • Python programming
  • C/C++/ Java programming
  • Low-Level security vulnerabilities such as root-kits etc.
  • Basic cryptography
  • Hardware security fundamentals such as dealing with common interfaces, reading schematics is highly desirable
  • Basic fuzzing experience
  • Knowledge of trusted computing, root of trust, device sanitization standards are a bonus

Career Level - IC3

The candidate will be responsible for basic planning, design and build of security systems, applications, environments and architectures.

Candidates will 

• Oversees the implementation of security systems, applications, environments and architectures and ensures compliance with information security standards and corporate security policies and procedures.
• Assist in development of incident response capabilities, training, and tool validation.
• Research, evaluate, track, and manage information security threats and vulnerabilities in the area of hardware and firmware
• Work with team members and engineers across organizations to verify bug fixes, proof of concepts
• Create tooling to automate testing of system security parameter settings and other tests as needed
• Performing fuzzing using current tooling and extend tooling as needed
• Assist creation of crypto operation ceremonies scripts, conduct ceremonies and perform post processing on secrets generated
• Review device sanitization solutions to ensure safe disposable/reuse of equipment

Disclaimer:

Certain US customer or client-facing roles may be required to comply with applicable requirements, such as immunization and occupational health mandates.

Range and benefit information provided in this posting are specific to the stated locations only

US