Cloud Security Engineer (CSE 0124)

At Skroutz, we have one simple yet powerful mission/vision: we aim to amaze. And this vision has been hardcoded into our DNA since day one. Back when we started our journey in 2005 as a price comparison engine, we created an innovative shopping tool for our users and shaped the future of e-commerce in Greece.

Today as the biggest marketplace in Greece, we continue to believe that happy customers equal happy merchants and it’s our job to understand and anticipate their needs and offer them an unparalleled, doubt-free experience. And to do so, we are always searching for new ways to make them say “wow”: Skroutz Plus (our first subscription-based service), Skroutz Last Mile (our parcel distribution company) and Skroutz Point (the first network of smart lockers in Greece) to name a few!

To create amazing experiences, we need amazing people! People that share the same passion and enthusiasm for eCommerce and technology as we do.

Sounds like you?

#AimToAmaze

Our engineering values

• Know your Tech. Develop and master your craft, sharpen your tools. Be proud of your work.
• Release early & Iterate. Deliver prototypes and start gathering important feedback early on. Use that feedback to guide you. Don't be afraid to compromise, make sure to come back & tidy things up.
• Be a team player. Offer your help, listen and seek to understand. Step up & take initiative.
• Don't over anything. Don't over-engineer, over-analyze, over-regulate, you get it.
• Enjoy your work. Celebrate success.

Technologies we use

Our main product is a Ruby on Rails application, running on a hybrid infrastructure. Our infrastructure consists of 500+ virtual machines, containers & serverless workloads, primarily running Debian GNU/Linux and AWS and spans at least 3 physical locations. 

Core products and technologies we use include:

• AWS cloud platform
• Terraform
• Kubernetes / Helm / EKS
• Elasticsearch + Elastic Security
• Cloudflare
• Github / Github actions
• MariaDB/RDS, MongoDB, Redis, Kafka
• Puppet for server automation
• Ruby on Rails / Python / Go
• KVM/Ganeti

How will you contribute to Skroutz vision

We are looking for an experienced Cloud Security Engineer with a Software Engineering or DevOps background to join our Security Team at Skroutz. The Security Team is part of our Platform division and aims to tackle complex security issues, provide the tools necessary for our product teams to produce secure code and guide the rest of the Platform division to secure our extensive hybrid infrastructure.

What you will be doing

• Build and deploy a containerized security service cluster on Amazon Web Services
• Conduct security assessments for internal and external-facing applications & infrastructure based on containers, kubernetes, serverless and managed services
• Integrate and consume cloud log sources into a centralized SIEM solution
• Develop Infrastructure-as-Code Terraform modules for security features/services
• Develop and maintain internal tools around security and integrate 3rd party security solutions (e.g. automated security audit and remediation, infrastructure security intelligence gathering, IAM platform etc.)
• Continuously educate infrastructure and cloud engineering teams around security concepts and security best practices
• Draft high-level cloud architectures and choose relevant security controls for cloud workloads and cloud-native applications

Requirements

• At least 3 years of professional working experience as a Cloud Security Engineer/Security Architect or DevSecOps engineer or a relevant security position
• Solid CS background, accompanied by a genuine interest in cybersecurity, continuously growing your skills & knowledge
• Good working knowledge of at least one programming language (Ruby, Python and/or Go will be considered a plus)
• Familiarity with Linux, containers and serverless functions from a security viewpoint and relevant security hardening experience for cloud workloads
• Familiarity with Kubernetes, Terraform, Amazon Web Services and/or the Elastic stack and their security functions and best practices
• Ability to own a cybersecurity project end-to-end, including researching, designing the architecture, implementing, integrating, testing, deploying & monitoring a solution
• Good communication and interpersonal skills, being a team player
• Ability to inspire and motivate fellow team members to achieve individual and company­ goals
• Lead-by-example mentality

We will appreciate if you have

• Worked as a DevSecOps or Full-Sta