IT Cloud Security Manager

About the job

Join a team of more than 25,000 team members, comprised of our home office and over 215 clubs and 3 distribution centers in 17 states. We’re committed to delivering value and convenience to our Members, helping them save every day on everything they need for their family and home. BJ’s Wholesale Club offers a collaborative, team-oriented environment where all team members can learn, grow and excel.

Under the direction of the CISO, this role’s primary function is to secure and monitor BJ’s public cloud footprint in AWS, Azure and GCP. The role is responsible for developing enterprise standards and supporting frameworks for secure computing in multi-cloud hybrid environments and digital commerce. Role will participate in the governance process to ensure adherence to industry standards, best practices, and all relevant BJ’s security policies. Additionally role collaborates with the cloud operations and software development teams to identify, evaluate and architect key security controls.

Responsibilities include, but are not limited to:

• Develop and maintain a Cloud Security Operating Model for BJ’s
• Manage security architecture in AWS, Azure and GCP
• Ensure cloud and digital commerce security strategies are aligned and operationalized
• Lead security for DevOps (secure coding, software composition analysis, CI/CD pipeline) in a fast-paced digital commerce environment and own the security gates in the development lifecycle
• Define SAST, DAST, RASP strategy for internally developed applications
• Manage security for APIs, containers, infrastructure as code, serverless functions
• Manage Cloud Security Posture Management (CSPM) and Cloud Workload Protection (CWP)
• Manage external DNS, Web Application Firewall, and Bot Management solutions and strategies
• Stay abreast of security trends and new technologies that will enhance BJ’s current and future data security architecture
• Execute security related services, process assessments, and evaluations based on NIST, ISO and ITIL standards and guidelines for all Business Plan initiatives across multiple technologies, platforms, and systems
• Lead and direct security components throughout systems development lifecycle, including requirements definition, proposal development, functional, non-functional, technical design, vendor analysis and selection, construction and testing, ensuring strong disciplines across networks, application security, middleware, database security with risk identification and enterprise encryption (PKI, TLS, HTTPS and digital certificate management)
• Develop and audit for security governance strategies and controls and work with various IT groups to develop processes, procedures and help with on-going internal compliance needs
• Provide subject matter expertise and effective communications across the Enterprise, to all members of IT, business partners, the Information Security team, and external vendors/partner, by providing timely collection and dissemination of information

Requirements

• Bachelors (or foreign equivalent) degree in Computer Science or related field is required
• Proven thought leadership in the Cloud and digital space is essential for this role
• Minimum of 7 years of experience in Information Technology, with a concentration on Information Security
• In-depth knowledge of information security practices, threat modelling, developing governance frameworks and strategies
• Proven skills/experience with encryption, Internet security, network access control, data leakage prevention, security configurations, risk assessments, and other tools/techniques used to ensure appropriate security controls and monitoring
• Strong communication, collaborative attitude and consensus building is a must
• Solid knowledge of security related industry standards and frameworks, such as PCI DSS, ISO 27001/2, NIST CSF, CIS Critical Security Controls, OWASP, ITIL
• Cloud security certifications preferred: AWS Certified Cloud Practitioner, AWS Certified Security, Azure Security Engineer, Certified Cloud Security Professional (CCSP)
• Desired certifications include: Certified Information Systems Security Professional (CISSP), Certified Information Security Manager (CISM), Certified Ethical Hacker (CEH), Certified Secure Software Lifecycle Professional (CSSLP)