Cyber Security DevOps Lead

Job purpose / role:

To assist, review and validate in implementations of cybersecurity requirements across development activities in Business Technology.

Areas of responsibility:

• Follows all relevant departmental policies, processes, standard operating procedures and instructions so that work is carried out in a controlled and consistent manner
• Follows the day-to-day operations related to own job to ensure continuity of work
• Supports projects or change initiatives through the preparation of technical plans and application of cybersecurity and DevOps design principles.
• Selects appropriate testing approach for automated testing of cybersecurity controls and countermeasures in the DevOps pipeline.
• Analyses and reports on test activities, results, issues and risks, for the cybersecurity initiatives within the DevOps pipeline.
• Plans the capture and management of configuration items and related information for cybersecurity controls and countermeasures within the DevOps pipeline.
• Develops, configures and maintains tools (including automation) to identify, track, log and maintain accurate, complete and current information for cybersecurity controls and countermeasures within the DevOps pipeline.
• Reports on the status of configuration management. Identifies problems and issues to recommend corrective actions, and report on progress cybersecurity initiatives within the DevOps pipeline.
• Assesses and analyses release components for input to release scheduling, maintains and administers tools and methods for cybersecurity software delivery, deployment and configuration of the DevOps pipeline.
• Conducts vulnerability and baseline configuration scanning, change related penetration and security testing activities such as initial information gathering and standard probing; and engagement with engineering/ product teams to resolve identified security vulnerabilities
• Assists in ensuring security is embedded as part of the agile deployment covering sprint planning, defining security user stories and test cases, participating in scrum cadence and sprint retrospectives
• Use security testing and code scanning tools to conduct code reviews
• Perform secure program testing, review, and/or assessment to identify potential flaws in codes and mitigate vulnerabilities.
• Address security implications in the software acceptance phase including completion criteria, risk acceptance and documentation, common criteria, and methods of independent testing.
• Perform risk analysis (e.g., threat, vulnerability, and probability of occurrence) whenever an application or system undergoes a major change.
• Apply coding and testing standards, apply security testing tools including "'fuzzing" static-analysis code scanning tools, and conduct code reviews.
• Contributes to the identification of opportunities for continuous improvement of processes and practices taking into account ‘international best practice’, improvement of business processes, cost reduction and productivity improvement
• Assists in the preparation of timely and accurate reports of Riyad Bank to meet company and department requirements, policies and standards
• Complies with all relevant safety, quality and environmental management policies, procedures and controls to ensure a healthy and safe work environment
• Performs other related duties or assignments as directed within the confinement of the departmental roles and responsibilities.

Qualifications & experience:

Minimum Qualifications:

• Bachelor’s degree in Computer Science, Information Technology or equivalent.

Minimum Experience:

• 6-8 years of relevant experience in IT or Cyber Security (SOC, incident response, vulnerability management, penetration test, red teaming)

Language:

English: Advanced