The IT & Security team

The IT & Security team at OpenZeppelin is responsible for the planning, execution, and delivery of the IT & Information Security Program that supports OpenZeppelin processes, technologies, products, and customers. The team manages the company’s IT and Security Operations, leads Governance Risk and Compliance initiatives, and supports Product Security activities and processes, led by the Head of IT & Security.

What you’ll be doing

• Guide the DevOps team to implement cloud security and compliance controls.
• Partner with development teams to design, implement and enhance security best practices in the SDLC and our software offerings.
• Create and maintain IT and cloud security policies.
• Work alongside other security team members to implement and maintain company-wide security best practices of all IT infrastructure including applications and endpoints devices.
• Support systems access provisioning and deprovisioning as well as onboarding and offboarding activities.
• Execute internal IT risk assessments and third-party risk assessments, as well as support the remediation of the findings.
• Assist with SOC 2 internal audits.
• Review periodically the security configurations of our systems.
• Learn new concepts, skills, and technologies to propose and implement new IT and security solutions.

You have: 

• 3 to 5 years of IT security, application and cloud security experience.
• Experience designing and implementing IT security controls in general and in AWS cloud in particular.
• Experience with DevSecOps and Agile methodologies.
• Proven experience building productive relationships with internal teams and partners.
• Curiosity and research skills to find IT and security solutions for our business needs.
• Excellent verbal and written communication skills to effectively exchange ideas and information with other teams and to provide assistance for IT and security matters

Nice to have

• Understanding of APIs and how to develop automation utilizing API functionality of tools and solutions.
• Previous experience with Disaster Recovery Planning and Incident Response.
• Previous experience managing Google Workspace environments.
• Security certifications, such as CISSP, CISM, or GIAC certifications.
• Knowledge of or exposure to common information security management frameworks, such as ISO/IEC 27001, NIST 800-53, NIST Cybersecurity Framework, CIS controls, or SOC 2 Type 2 reports and audit processes.
• Exposure to Blockchain / Web3 technologies and infrastructure.

Logistics

Our interview process takes place on Zoom and tends to consist of the following stages:

• Recruiter call (45 minutes)
• Hiring Manager call (45 minutes)
• Team member interview (1 hour)
• Leadership call (30 minutes)
• Paid work test
• Reference checks

Please let us know if you require any accommodations for the interview process, and we’ll do our best to provide assistance.