The posting
At IBM Infrastructure & Technology, we design and operate the systems that keep the world running. From high-resiliency mainframes and hybrid cloud platforms to networking, automation, and site reliability. Our teams ensure the performance, security, and scalability that clients and industries depend on every day. Working in Infrastructure & Technology means tackling complex challenges with curiosity and collaboration. You’ll work with diverse technologies and colleagues worldwide to deliver resilient, future-ready solutions that power innovation. With continuous learning, career growth, and a supportive culture, IBM provides the opportunities to build expertise and shape the infrastructure that drives progress.
As a seasoned Security Professional, you will play a critical role in ensuring the security, regulations, risk, and compliance of our organization. You will collaborate with various teams to operationalize security projects and provide guidance on regulations to account teams.
Your primary responsibilities will include:
• Lead Cybersecurity Investigations: Participate in cybersecurity investigations, ensuring timely and effective responses to incidents, and review and approve root cause analysis and action plans.
• Deploy Data Privacy Regulations: Assess the impact of new data privacy regulations on our portfolio, deploy and track implementation, and develop dashboards for regulatory operational activities.
• Provide Regulatory Guidance: Offer help and guidance on regulations to account teams, enabling them to navigate complex regulatory requirements.
• Operationalize Security Projects: Work with other teams to translate security projects into business-as-usual tasks, ensuring seamless execution and ongoing management.
• Monitor Incident Trends: Track incident and action plan trends, identifying areas for improvement and optimizing our security posture.
Design, develop, test, and maintain scalable backend applications and automation tools using Python.
Develop secure REST APIs and backend services following secure coding best practices.
Perform and analyze Static Application Security Testing (SAST) and Dynamic Application Security Testing (DAST) scans.
Review and triage Mend vulnerability findings and drive remediation through the PSIRT process.
Coordinate and support Security Risk Testing (SRT) and Penetration Testing activities.
Analyze security findings, identify false positives, prioritize genuine vulnerabilities, and work with development squads to drive remediation.
Create, maintain, and continuously update product threat models as the application evolves.
Conduct security design and architecture reviews to identify potential risks and recommend mitigation strategies.
Integrate security scanning and automation into CI/CD pipelines to enable DevSecOps practices.
Collaborate with architects, developers, and security teams to embed security throughout the SDLC.
Act as the security champion for the product by promoting secure coding practices and improving the overall security posture.
7+ years of hands-on experience in Python application development, building scalable backend applications and REST APIs.
Strong programming skills in Python with experience in object-oriented design, debugging, performance optimization, and automation.
Hands-on experience with Application Security and Secure SDLC practices.
Hands-on experience with SAST, DAST, Mend (Software Composition Analysis), PSIRT processes, and Security Risk Testing (SRT).
Experience coordinating or supporting internal/external Penetration Testing activities.
Strong experience analyzing vulnerability reports, triaging security findings, identifying false positives, and driving remediation with development teams.
Hands-on experience creating, maintaining, and reviewing product threat models.
Strong understanding of secure coding principles and common application security vulnerabilities.
Experience integrating security tools into CI/CD pipelines and DevSecOps workflows.
Experience with Git, CI/CD tools (Jenkins/GitHub Actions), and Agile software development practices.
Excellent analytical, problem-solving, communication, and stakeholder management skills.
Experience with application security tools such as SonarQube, Burp Suite, ZAP, or equivalent.
Experience performing architecture security reviews and security design assessments.
Experience with cloud-native applications, Docker, Kubernetes/OpenShift, and API security.
Familiarity with threat modeling tools would be advantage.
Experience automating security validation and remediation using Python.
Knowledge of Infrastructure as Code (Terraform/Ansible) security.
Security certifications are an added advantage.
Experience working in Agile/Scrum teams and collaborating across global engineering organizations.
