Principal Security Engineer - Hardware Security

Oracle Cloud Infrastructure Security Engineer

The Oracle Cloud Infrastructure (OCI) team can provide you the opportunity to build and operate a suite of massive scale, integrated cloud services in a broadly distributed, multi-tenant cloud environment. We offer unique opportunities for smart, hands-on security engineers with the expertise and passion to solve difficult problems in distributed highly available services and virtual infrastructure. At every level, our engineers have a significant technical and business impact designing and building innovative new systems to power our customer's business critical applications.

The OCI Hardware Security group conducts security assessments of the production hardware that runs our cloud, and develops the requirements for future networking, storage, compute components. We work closely across Oracle, with third-party vendors, and with standards organizations to influence the next generation of hardware platform security. In addition to defining the best hardware, OCI HW Security knows that platform security also depends on how that hardware is used. To that end, HW Security also works closely with OCI's operations and engineering teams, constantly striving to improve Oracle Cloud's overall operational security posture by defining the supply chain and operational requirements to establish best practices for managing security for every device in our data centers.

A security-focused engineer at any level can have significant technical and business impact. Come shape the future of one of the largest clouds on earth with us. Overall, the OCI Security Architecture team performs a variety of work ranging from cloud security, application security, vulnerability analysis, threat modeling, and hacking/enterprise network penetration. The biggest challenges for the team are the dynamic and fast growth of the business, driving us to improve our systems, tools, and automation to scale to our security expertise several orders of magnitude greater than what we can support today. We understand that software is living and needs investment. The challenge is making the right tradeoffs, communicating those decisions effectively, and crisp execution.

Responsibilities

Career Level - IC4 + Develop and communicate requirements for new vendors and hardware (compute, storage, networking) + Perform architectural reviews, penetration testing, vulnerability analysis of compute infrastructure hardware such as o Servers (Intel, AMD and ARM) o Baseboard Management Controllers such as Oracle's ILOM o UEFI and platform firmware o Smart NICS o Storage devices o Network controllers and other peripherals Network hardware/firmware, topology, and security expertise + Provide consulting on security risk associated with compute hardware and firmware in the context of cloud usage. + Provide consulting and review of device sanitization as per NIST-800-88 R1 standards. + Provide standard operating procedures for safe use of compute hardware through its lifecycle i.e., provisioning, operations and reuse/decommission.

Skills

Engage with Oracle Hardware Division and third-party vendors to understand their roadmaps. + Create planning roadmaps to drive multi-year security improvements across the OCI Infrastructure + Review or assess engineering changes, or revisions of, an existing component. E.g.: new firmware for a device, vendor revision of an existing device Identify and participate in external standards groups to drive improvements across the industry + Consult development teams and third-party vendors in design and architecture of secure systems. + Champion and consult on secure development life cycle practices. + Communicate and educate Senior Management on key Security topics and directions.

Disclaimer: Certain US customer or client-facing roles may be required to comply with applicable requirements, such as immunization and occupational health mandates. Range and benefit information provided in this posting are specific to the stated locations only US: Hiring Range in USD from: $109,200 to $223,400 per annum. May be eligible for bonus and equity.

Oracle maintains broad salary ranges for its roles in order to account for variations in knowledge, skills, experience, market conditions and locations, as well as reflect Oracle's differing products, industries and lines of business. Candidates are typically placed into the range based on the preceding factors as well as internal peer equity. Oracle US offers a comprehensive benefits package which includes the following:

• Medical, dental, and vision insurance, including expert medical opinion
• Short term disability and long term disability
• Life insurance and AD&D
• Supplemental life insurance (Employee/Spouse/Child)
• Health care and dependent care Flexible Spending Accounts
• Pre-tax commuter and parking benefits
• 401(k) Savings and Investment Plan with company match
• Paid time off: Flexible Vacation is provided to all eligible employees assigned to a salaried (non-overtime eligible) position. Accrued Vacation is provided to all other employees eligible for vacation benefits. For employees working at least 35 hours per week, the vacation accrual rate is 13 days annually for the first three years of employment and 18 days annually for subsequent years of employment. Vacation accrual is prorated for employees working between 20 and 34 hours per week. Employees working fewer than 20 hours per week are not eligible for vacation.
• 11 paid holidays
• Paid sick leave: 72 hours of paid sick leave upon date of hire. Refreshes each calendar year. Unused balance will carry over each year up to a maximum cap of 112 hours.
• Paid parental leave
• Adoption assistance
• Employee Stock Purchase Plan
• Financial planning and group legal
• Voluntary benefits including auto, homeowner and pet insurance

The role will generally accept applications for at least three calendar days from the posting date or as long as the job remains posted. Career Level - IC4