As a Senior Security Engineer at Peloton, you will be responsible for supporting the operations and overall strategy of ongoing security and compliance at Pelotons’ Taiwan/Asia Headquarters.

You will work closely with Pelotons’ IT and Information Security teams, providing security and compliance guidance to existing and new information and operational technology footprints

Responsibilities:

Covering primary perimeters in Taiwan/Asia:

• Architect, deploy, and maintain Pelotons’ security standards
• Evangelize security throughout Pelotons’ sites and empower end users to do their jobs securely with professionalism
• Research and analyze potential new threats, attack vectors and risks and identify mitigation efforts
• Prioritize vulnerabilities for remediation with the business and accountable IT teams
• Collaborate with Pelotons’ IT and Security teams, continually improving the security and compliance posture of Pelotons’ facilities.
• Work with cyber analysts and security engineers to develop threat models, detections, incident response playbooks, and maintain tooling to enrich security intelligence.
• Coordinate and develop IT risk control and compliance management activities

Functional Requirements:

1. 6+ years experience working in a security and compliance role
2. You have demonstrated cross domain knowledge and experiences in cloud and infrastructure security best practices, incident response, vulnerability management, automation, IT compliance and risk control
3. You know how to identify security gaps and effectively put together a plan to remediate them.
4. You are able to think offensively and defensively about security. You understand how an attacker may compromise a system or network, and you can implement the mitigating controls to prevent a breach.
5. You understand the importance of collecting security relevant logs from an entire environment, providing the necessary information to then be turned into intelligence, finding the signal in the noise.
6. You can work cross functionally between technical and business teams, evangelizing security best practices, policy, and procedures.

Competency Requirements:

Demonstrable experience & knowledge with… 

1. Scripting & API: Scripting (Bash, Python, Go, etc) for automation, as well as solve complex security challenges and integrate security solutions via APIs.
2. Enterprise-scale security technologies: e.g. Vulnerability Management, HIDS/NIDS, PKI, SSO, IAM, Privileged Access Management.
3. System incident management and response: Linux, MacOS, and Windows environments.
4. Configuration management tools; Ansible, Chef, Puppet, etc.
5. Cloud Security Supplier mgmt and Tooling: e.g. AWS, GCP; tools such as Guarduty, Cloudtrails, SecurityMonkey, ScoutSuite, etc.
6. EDR (Endpoint Detection and Response) tools: e.g. Crowdstrike, GRR, osquery, Sysdig, Carbon Black, Endgame, Tanium etc.
7. Development processes and environment tools: e.g. Git, Jira, Confluence.

Bonus:

Hands-on / Working Experiences with...

• Operational technology and manufacturing 
• Container Technology (Docker, EKS, GKE, Kubernetes, Openshift, ) and their respective security tools (Twistlock, Stackrox, Aqua, Sysdig, etc)
• Firewalls (Meraki, Palo Alto, PFSense, etc)
• SOAR, CASB, DLP technologies
• Agile
• Security compliance & quality management: ISO9001, 27001, SOX ITGC audit facilitation, remediation
• China IT compliance, cyber risk and data protection practices

Certifications:

•  CISSP, OSCP, Security+