Cloud Security Engineer

Cloud Security Engineer

Founded on a legacy of more than 120 years in banking, Bank OZK is much more than just a company. We're nationally recognized as an industry leader in financial services. That means we combine exceptional service with innovative technologies to deliver smart solutions to our clients across the country. We're investing in small businesses, fueling economies in local communities and changing skylines in the largest cities across America. Here, we're not simply filling roles. We're fostering even greater careers.

The foundation for a great career starts with an exceptional team and a comprehensive benefits package. We believe in providing our dedicated team members with the best resources to support their physical, mental and financial wellbeing, including generous PTO, 401(k) matching, health, dental, vision (and pet!) insurance as well as special perks and discounts.

Job Purpose & Scope

Responsible for ensuring the secure design, implementation, and operation of Bank OZK's cloud environments. The Cloud Security Engineer works closely with IT, Labs, Data teams, Third-Party Risk Management, and application owners to implement cloud security controls and enforce compliance with Bank policies and industry regulations.

Essential Job Functions

1. Supports the onboarding and risk assessment of new Cloud Service Providers (CSPs) through the Third-Party Risk Management (TPRM) process.
2. Evaluates CSP security controls against Bank OZK's Cloud Security Standard and regulatory requirements, ensuring that proposed cloud solutions meet all legal and compliance criteria before approval.
3. Implements and maintains cloud security controls across SaaS, PaaS, and IaaS environments, applying Bank-approved secure configuration baselines (leveraging industry benchmarks like CIS) for cloud resources (VMs, containers, storage, etc.) and enforces "secure-by-default" settings during deployments.
4. Collaborates with OZK Technology teams to design cloud architectures that incorporate network segmentation, encryption, and other security best practices from start to completion.
5. Integrates cloud platforms and applications with the Bank's centralized Single Sign-On (SSO) and identity management systems.
6. Ensures that cloud activity logs are enabled, collected, and integrated with Bank OZK's Security Information and Event Management (SIEM) and monitoring systems.
7. Develop detections or alert rules to monitor cloud events for signs of compromise or policy violations.
8. Investigates and responds to cloud security incidents in coordination with the Security Operations Center (SOC), helping to remediate issues and implement lessons learned.
9. Manages cloud environments for security compliance and misconfigurations using automated Cloud Security Posture Management (CSPM) tools or scripts.
10. Performs configuration audits and vulnerability scans of cloud assets and works with infrastructure and application teams to remediate identified weaknesses or document risk acceptances according to the Bank's vulnerability management standards.
11. Collaborates with software development teams and Application Security Engineers on secure deployment of cloud-native applications. Ensures cloud-hosted applications follow secure coding and deployment practices aligned with Bank standards (e.g. perform threat modeling, enforce secure SDLC requirements).
12. Implements cloud-native application security controls such as web application firewalls (WAFs) for internet-facing apps and ensure proper network restrictions (security groups, private endpoints) for sensitive data stores
13. Embeds security into the CI/CD pipeline and infrastructure-as-code processes. Works with DevOps engineers to implement automated security checks for cloud infrastructure templates and application code (e.g. IaC scanning, container image scanning, secret leakage detection) [1] [2] .
14. Advises on secure configuration of CI/CD tools and use of secure secret management for pipeline credentials. Promote DevSecOps best practices so that security is an integral part of cloud deployment workflows.
15. Provides guidance and training to IT cloud engineers, developers, and business units on cloud security requirements and secure cloud service usage.
16. Ensures that cloud security controls and processes are well-documented and ready for audits or examinations.
17. Provides evidence of compliance with the Bank's Cloud Security Standard and applicable regulations during audits (internal, external, or regulatory). Address audit findings or recommendations related to cloud security by implementing corrective actions or process improvements.
18. Stays current with relevant regulatory guidelines (e.g. FFIEC cloud computing guidance, NYDFS cybersecurity requirements).
19. Stays informed on evolving cloud security threats, tools, and best practices, especially as they relate to financial institutions.
20. Proactively recommend and implement enhancements to Bank OZK's cloud security posture.
21. Performs or assigns other tasks and assists other team members as necessary.

Knowledge, Skills & Abilities

1. Knowledge of integrating security testing tools into build/deployment pipelines and managing secrets for automation.
2. Ability to work with DevOps/CI-CD pipelines and using Infrastructure-as-Code (Terraform, CloudFormation, etc.) in a secure manner.
3. Advanced security-minded with the ability to assess risk in cloud architectures.
4. Ability to consistently apply principles of confidentiality, integrity, and availability when evaluating cloud solutions and making risk-based decisions aligned with the Bank's risk appetite.
5. Strong diligence in configuring and reviewing cloud settings, logs, and processes to ensure nothing is overlooked. Vigilant in following through on issues until they are fully resolved and verified.
6. Strong critical thinking skills to analyze complex technical problems or security events in cloud environments.
7. Ability to break down problems, identify patterns or root causes, and develop effective solutions or mitigations.
8. Ability to effectively communicate technical cloud security issues into business impact terms.
9. Excellent interpersonal skills with an ability to work collaboratively on cross-functional teams, clearly articulate recommendations, and influence secure outcomes without formal authority.
10. Ability to work in a fast-paced, evolving environment. Able to adjust to new cloud services, threats, and regulatory requirements as they emerge, updating strategies and tactics accordingly.
11. Ability to be self-motivated and proactive. Takes ownership of projects and problems; drives improvements in cloud security practices without waiting for direction. Demonstrates a strong sense of responsibility and ethics, especially important in handling sensitive systems and data.
12. Ability to demonstrate initiative to accomplish work objectives.

Basic Qualifications

1. Bachelor's degree in Information Systems or related field; or commensurate work experience, required.
2. Three (3) years' work experience in a regulated financial institution or other heavily regulated environment, required.
3. Familiarity with banking-specific security considerations and third-party risk management practices for cloud services, required.
4. Professional security certifications related to cloud and information security (e.g., CCSP, CISSP, AWS/Azure Security Engineer, or CompTIA Security+), preferred.

Job Expectations

Operate customary equipment and technology used in a business environment, with or without accommodation.

Note: This description is not an exhaustive list of all job functions, duties, skills, and job standards required. Other job functions, duties, skills, and standards may be added. Management reserves the right to add or change the job requirements at any time.

EEO Statement

Bank OZK is an equal opportunity employer and gives consideration for employment to qualified applicants without regard to race, color, religion, sex, national origin, age, sexual orientation, gender identity, disability status, protected veteran status, or any other characteristic protected by federal, state, and local law. Member FDIC.