Principal Security Operations (Secops) Engineer

As a Principal Security Operations Engineer at Vimeo, you will engage in a variety of activities, either offensive, defensive, or some combination thereof, ultimately aimed at safeguarding our 300+ million users who entrust Vimeo with their content every day.

You'll plan, carry out, and lead security initiatives to monitor and protect sensitive data and systems from infiltration and cyber-attacks.

You will likely collaborate frequently with and support developers, as well as members of the infrastructure security team, the compliance team, IT, Product, and other teams throughout the organization.

You love to solve puzzles, and are a great team player.

This role is remote.

What you'll do:

Depending on your preferences and the current needs of the team, you may either focus on just some of the following areas, or you may choose to become involved with all of them.

• Participate in incident response activities, including investigating security incidents and responding to security alerts.
• Automate security processes using scripting and other automation tools.
• As a Principal SecOps Engineer, you will be responsible for ensuring the security of our systems and infrastructure. You will work closely with our development, DevOps teams to identify and remediate vulnerabilities, implement security best practices, and automate security processes. You will also monitor and respond to security incidents and maintain compliance with industry and regulatory standards.
• Implement and operate cloud security hardening and cloud security posture management across Google cloud and AWS.
• Develop and maintain security policies and procedures, and ensure compliance with industry and regulatory standards.
• Collaboration with the compliance and privacy team — help ensure that our company complies with industry best practices and standards
• Process improvements — help strengthen our own internal processes and procedures
• Collaborate with development and DevOps teams to implement security best practices throughout the software development and infrastructure lifecycle.
• Conduct security assessments of our systems and infrastructure to identify vulnerabilities and risks, identify risk owners and implement mitigating controls.
• Stay up-to-date with the latest security threats, vulnerabilities, and technologies.
• Implement and maintain security controls, including access controls, Zero trust network access (ZTNA), network segmentation, and security monitoring tools.
• Collaborate with SRE, AppSec and Information technology around vulnerability management, endpoint hardening, detection and response.
• Design and operate identity management, lifecycle, governance and SSO.

Skills and knowledge you should possess:

• Strong knowledge of security best practices and industry standards, such as NIST, CIS, and ISO.
• Excellent problem-solving skills and the ability to work well under pressure.
• 6+ years of experience in a security or operations role, preferably in a cloud-based Linux environment.
• At least an upper-intermediate level of English
• Strong scripting skills using Python, shell, or other scripting languages.
• Bachelor's degree in Computer Science, Information Technology, or a related field, or equivalent work experience.
• Relevant certifications such as CISSP, CCSP, or AWS Certified Security Specialty are a plus.
• Confident with common SDLC components, like git, Jira, Jenkins, etc
• Good communication and interpersonal skills.Confident working in and across cloud environments like AWS and GCP. Detailed knowledge of at least one cloud environment.
• 3+ years experience with container and container orchestration systems
• Experience with security tools such as IDS/IPS, SIEM, vulnerability scanners, and endpoint protection.
• Experience with automation tools such as Terraform, Ansible, or Chef.

Bonus points (nice skills to have, but not needed):

• Experience with Crowdstrike and OKTA.
• Experience implementing zero trust network access such as Z-Scaler, Warp, Google beyondCorp etc.
• Experience with implementing Fedramp and/or HIPAA.
• Experience with system security hardening guidelines and SDLC principles
• Understanding of FIDO2 and machine certificate authentication flows.
• Experience implementing identity lifecycle including provisioning, quarterly access reviews, role management and deprovisioning.

Targeted Base Salary Range: $162,000 to $226,000

The base salary range listed above is for candidates located in the U.S., including the New York City metro area.

At Vimeo, we strive to hire and nurture amazing talent across the globe. Actual salaries will vary depending on factors including but not limited to experience, specialized skills, internal alignment and a candidate's home base.

Base salary is just one component of Vimeo's total rewards philosophy. We offer a wide range of benefits and perks that appeal to the variety of needs across our diverse employee base! Other rewards may include bonus or commission, Restricted Stock Units (RSUs), paid time off, generous 401k match, wellbeing resources, and more.

#LI-MM1