IT Security Specialist
About the role
Orfium is seeking an experienced IT Security Specialist to join their Cloud & Infrastructure team. The role involves strengthening the security of cloud platforms, infrastructure, engineering practices, and internal systems, while supporting the maturity of the Information Security programme. Key responsibilities include supporting cloud security strategy, overseeing IT security protocols, ensuring regulatory compliance, conducting security assessments, managing identity and access controls, deploying data loss prevention strategies, and collaborating with various teams to drive security improvements. The position requires at least 3 years of relevant experience, strong technical and communication skills, and the ability to work cross-functionally in a collaborative, international environment.
Must have
- 3+ years of experience in security engineering, cloud security, infrastructure security, or a similar role.
- Strong understanding of cloud security, networking, IAM, application security, vulnerability management, and incident response.
- Hands-on experience assisting with engineering and infrastructure teams to design and implement secure systems.
- Experience with ISO 27001, SOC 2, security audits, risk assessments, and compliance-related activities.
- Familiarity with security tooling such as vulnerability scanners, cloud security controls, endpoint/security platforms, and access governance tools.
- Ability to investigate security issues, coordinate remediation, and communicate risks clearly to technical and non-technical stakeholders.
- Strong problem-solving skills, autonomy, ownership, and ability to manage multiple priorities.
- Ability to collaborate effectively with cross-functional teams, including Cloud & Infra, Engineering, Legal Team & IT Operations
- Fluent English language communication skills, written and verbal.
Nice to have
- Experience supporting security in SaaS, product, and data-heavy technology environments.
- Experience with AWS, GCP, GitHub security, CI/CD security, WAF, secrets management, or secure software development practices.
- Familiarity with security awareness programmes, phishing response, tabletop exercises, and BCP/DRP processes.
- Experience with vendor security questionnaires, third-party risk, or customer security requirements.
- Eager / Implement New Security Best Practice with the Organization
- Security certifications such as ISO27001 Lead Implementer , CEH, Security+, AWS Security Specialty, or similar.
- Love for music!
Technologies
- AWS
- CEH
- CI/CD
- Cloud Security
- CompTIA Security+
- Cybersecurity
- DLP
- GCP
- GitHub
- IAM
- ISO 27001
- Penetration Testing
- SaaS
- Secrets Management
- SOC 2
- WAF
Highlights
The role offers a competitive salary package, participation in a stock options plan, hybrid work model, comprehensive private health and life insurance, extra paid time off, and the latest tech equipment. The company values diversity and inclusion and provides an international, collaborative work environment.
Jobs across Sri Lanka, watched for you.Colombo, Sri Lanka