Job Description
1. Delivery and Quality Management of Alibaba cloud Security Services (Including On-site/Inspection)
• Enhance the security posture of Apsara Stack projects through continuous security services (on-site support, inspections, risk assessments, etc).
• Establish security product services and operational assurance systems, building a comprehensive and reliable technical monitoring framework to ensure stability and security of online business systems.
• Develop onsite security operation processes, design and optimize daily service/operation workflows, and manage the quality of security service delivery.
2. Management, Delivery, and Technical Support for Alibaba cloud Major Event Safeguarding Projects.
• Conduct security risk assessments for Alibaba cloud during safeguarding period, propose reinforcement and remediation suggestions, and drive the implementation of security enhancements.
• Provide critical escort support services for customers during key periods, including duty shifts during safeguarding period, attack-defense drills, security incident handling, emergency response, forensic investigations, etc.
3. Development of Alibaba cloud Security Technical Strategies, Including Security Inspection Baselines and Solutions of Network, System, Middleware, Cloud Products and Applications, etc.
• Implement tailored security capabilities aligned with customer business scenarios (e.g., policy tuning, feature activation, configuration optimization of security products).
• Design security inspection baselines, deploy via productive tools, analyze detection results, and formulate remediation plans;
• Conduct technical validation to verify the effectiveness of security baseline risk remediation efforts.
4. Research and Establish Emergency Response Process Standards & Automated Tool Capabilities based on the development trends of alibabacloud.
• Track the latest security attack/defense techniques, threat landscapes, vulnerabilities, and tooling; operationalize capabilities in real-world scenarios.
• Research cloud-based implementations of the Identify-Protect-Detect-Respond-Recover (IPDRR) framework, formalizing operational standards and automated toolchains.
Position Requirement
• 5+ years of work experience in cybersecurity or related fields.
• Security Vendor Background: Experience at security service providers involving security services (penetration testing, security assessments, compliance consulting, security implementation, etc.) with relevant project exposure, including 3+ years of specialized expertise in one vertical security domain.
• Enterprise/Cloud Provider Background: Experience at large domestic/international internet firms, cloud providers, or client-side enterprises, primarily responsible for security operations (security assurance, holistic compliance, etc.), with deep expertise in one technical domain, plus experience in cross-team projects or leading small teams.
• Proven Deliverables: Possess relevant security operation project experience or demonstrable deliverables in specialized technical domains (e.g. security compliance, security operations, offensive/defensive security), including but not limited to: vulnerability discovery, security operation solutions, operational frameworks, compliance consulting projects, etc.
• Tool & Product Mastery: Proficient with self-developed and industry-standard security operation tools, cloud and industry security products and their features; familiar with differences in security capabilities of competing products; able to leverage strengths/avoid weaknesses from an overall defense perspective while feeding insights into tool/product optimization.
• Architecture Design: Capable of leading architectural design and implementation of security operation tools/systems, balancing technical ROI and functional enhancements.
• Project Delivery: Capable of independently delivering cross-regional/cross-industry operation projects; able to document best practices, pilot new technologies, and establish security management processes in key enterprise client engagements; serve as domain owner for assigned regions/fields.
• Collaboration Excellence: Strong teamwork and communication skills; understands team positioning within the broader organizational structure; maintain good collabration with business/stakeholder teams; resolves role/cognition conflicts proactively and drives reasonable solutions.
23551721