IT Security Specialist

IT Security Specialist

Orfium · Colombo, Sri Lanka · Full-time · Posted 2026-10-28

Workplace: on_site

Department: IT Admin

Description

We are seeking an experienced Security Specialist to join Orfium’s Cloud & Infrastructure team. In this role, you will help strengthen the security of our cloud platforms, infrastructure, engineering practices, and internal systems while supporting the continued maturity of our Information Security programme.

You will work closely with Cloud & Infra, Engineering, IT Operations, Legal, and business stakeholders to drive practical security improvements across areas such as cloud security, access governance, vulnerability management, security assessments, incident response, compliance, and security awareness

Responsibilities 

• Support the execution of Orfium’s cloud security strategy and roadmap by creating and supporting security controls across our cloud platforms and workloads
• Oversee IT security and data protection protocols across cloud-centric collaboration environments, ensuring secure operational continuity. .
• Architect and sustain robust information governance frameworks to optimize data integrity, classification, and secure handling. 
• Ensure strict adherence to cybersecurity standards and enforce complex regulatory compliance mandates across the organization. (ISO 27001, SOC2 etc…) 
• Run and support with security assessments, vulnerability reviews, penetration testing activities, and remediation follow-ups.
• Configure and administer stringent identity and access management (IAM) controls to systematically safeguard sensitive enterprise data. 
• Deploy comprehensive Data Loss Prevention (DLP) strategies and proactively monitor network and endpoint activity for policy infractions.
• Support business continuity, disaster recovery, vendor security reviews, and risk assessments.
• Collaborate with IT Operations on identity, access management, admin access, onboarding/offboarding controls, and security-related tooling. (Close work with Legal Team & IT )
• Deliver or support security awareness initiatives, helping employees understand threats such as phishing, social engineering, password security, device security, and safe internet practices.
• Author and maintain detailed technical documentation encompassing security controls, operational policies, and incident response procedures. 
• Stay up to date with emerging threats, security  trends, and cloud security best practices, and translate them into practical improvements for Orfium.
• Support with quarterly audit reviews, audit readiness, and evidence collection.

Requirements

• 3+ years of experience in security engineering, cloud security, infrastructure security, or a similar role.
• Strong understanding of cloud security, networking, IAM, application security, vulnerability management, and incident response.
• Hands-on experience assisting with engineering and infrastructure teams to design and implement secure systems.
• Experience with ISO 27001, SOC 2, security audits, risk assessments, and compliance-related activities.
• Familiarity with security tooling such as vulnerability scanners, cloud security controls, endpoint/security platforms, and access governance tools.
• Ability to investigate security issues, coordinate remediation, and communicate risks clearly to technical and non-technical stakeholders.
• Strong problem-solving skills, autonomy, ownership, and ability to manage multiple priorities.
• Ability to collaborate effectively with cross-functional teams, including Cloud & Infra, Engineering, Legal Team & IT Operations
• Fluent English language communication skills, written and verbal.

Nice to Have 

• Experience supporting security in SaaS, product, and data-heavy technology environments.
• Experience with AWS, GCP, GitHub security, CI/CD security, WAF, secrets management, or secure software development practices.
• Familiarity with security awareness programmes, phishing response, tabletop exercises, and BCP/DRP processes.
• Experience with vendor security questionnaires, third-party risk, or customer security requirements.
• Eager / Implement New Security Best Practice with the Organization
• Security certifications such as ISO27001 Lead Implementer , CEH,  Security+, AWS Security Specialty, or similar.
• Love for music!

Benefits

💰 Competitive salary package

🏠 Hybrid work model with flexibility to support your lifestyle

🏥 Comprehensive private health and life insurance coverage

🌴 Paid time off to recharge and take care of yourself

💻 The latest tech equipment to support your productivity and creativity

🌍 A collaborative, inclusive, and international work environment

About Us 

We are a global technology leader helping artists, songwriters, and copyright owners solve the most complex problems in the music industry through advanced rights management and data solutions. At Orfium, you’ll join a passionate, international team of developers, designers, scientists, and music lovers, all working together in a flexible, hybrid environment where innovation, openness, and ownership are at the heart of everything we do. We are looking forward to meeting with you!

EEO / Accommodation

At Orfium, we are proud to be an equal opportunity employer. We celebrate diversity and are committed to creating an inclusive environment for all employees and candidates—regardless of race, color, religion, gender, gender identity or expression, sexual orientation, national origin, genetics, disability, age, or veteran status.

Apply

Apply at Orfium

---

Powered by Workable