Senior Cloud Security Engineer in Geneva

The Senior Cloud Security Engineer serves as the principal technical authority on cloud information security, responsible for defining and executing the security strategy for WIPO's multi-cloud and hybrid environments. The role ensures resilient and compliant business solutions by embedding security‑by‑design principles into cloud architectures and driving secure adoption of cloud services through standardized patterns, automation guardrails, and advanced protection technologies.ResponsibilitiesServe as the principal technical authority for secure cloud architecture, designing and validating secure landing zones and reference architectures for AWS and other major public clouds (Azure/GCP).Collaborate with the Senior Security Architect to define and maintain security patterns for common workloads, ensuring alignment with WIPO’s policies and industry standards.Develop and implement frameworks to detect and remediate architectural drift, ensuring continuous alignment with security baselines.Lead the development and maintenance of reusable Infrastructure as Code (IaC) modules (e.g., CloudFormation, Terraform) to ensure the secure, repeatable, and auditable provisioning of cloud resources.Engineer and maintain automation scripts (Python, PowerShell, Bash) to enhance deployment reliability, security configuration, and operational efficiency.Audit IaC implementations to ensure adherence to best practices and integrate automated security checks and policy enforcement into CI/CD pipelines.Implement, document, and operate comprehensive cloud security baselines, including identity and access models (IAM), network segmentation, encryption standards, and secrets management.Orchestrate the integration and optimization of CrowdStrike and other cloud‑native security technologies into WIPO’s environments (including containers and serverless), creating associated playbooks and configuration documentation.Secure container orchestration platforms (Kubernetes, EKS/AKS/GKE) by implementing image scanning, policy enforcement, and runtime protection measures.Collaborate with Application Security (AppSec) and development teams to embed security into the application lifecycle, providing remediation guidance and threat modeling input.Refine and apply cloud governance frameworks, including account structures, tagging standards, and guardrails, to ensure compliance with WIPO policies and external standards (e.g., ISO 27001, CIS).Develop and maintain comprehensive technical documentation, including architecture diagrams, standard operating procedures (SOPs), and configuration baselines.Build organizational capacity by creating technical guidelines and delivering training/awareness sessions to mentor ICT and project teams on secure cloud engineering practices.Coordinate with vendors and service providers to ensure external solutions meet WIPO's technical and security requirements.Perform other related duties as required.RequirementsAdvanced university degree in information security, computer science, engineering, mathematics, business, or related discipline.A first‑level university degree in a relevant discipline plus two years of relevant experience in addition to the experience requested below may be accepted in lieu of an advanced degree.AWS Certified Solution Architect Associate certification.AWS Certified Security - Specialty (Desirable).Microsoft Certified: Cloud and AI Security Engineer Associate (Desirable).SANS SEC588 Cloud Penetration testing (or equivalent) (Desirable).SANS SEC540 Cloud Native Security and DevSecOps Automation (or equivalent) (Desirable).OSWA Offsec Web Assessor or OSWE Offsec Web Expert (Desirable).A minimum of 7 years working in the field of information security in an engineering or analysis capacity.At least three years of hands‑on experience in cloud security and engineering, with specific expertise in AWS and at least one other major public cloud platform (Azure or GCP).Proven track record in designing, deploying, and operating secure cloud workloads in production environments.Demonstrated experience in Infrastructure as Code (IaC) and automation, specifically using Terraform or CloudFormation to deploy secure cloud resources.Practical experience in securing container orchestration platforms (e.g., Kubernetes, EKS, AKS, GKE) and integrating security controls into CI/CD pipelines.Practical experience with endpoint/workload protection tools, including hands‑on experience with the CrowdStrike runtime agent.Proven track record of designing and operating security controls in production environments, including identity management (IAM), network security, and encryption.Experience working in large, complex, or regulated environments (such as international organizations, the public sector, or the financial industry).Experience with advanced CrowdStrike capabilities, including Cloud Security (CSPM/CWP), Identity Management and Protection, and/or Next‑Gen SIEM (Desirable).Experience in application security (AppSec), secure software development lifecycles (SSDLC), or DevSecOps practices (Desirable).Excellent written and spoken knowledge of English.Knowledge of other UN official languages, particularly French (Desirable).Deep knowledge of AWS, Azure, or GCP security services and configurations.Proficiency in scripting (Python, PowerShell or Bash) and IaC frameworks (Terraform or CloudFormation).Knowledge of endpoint/workload protection principles and technologies.Familiarity with DevSecOps principles, CI/CD pipelines, and security automation.Strong analytical, conceptual and problem‑solving skills with the ability to address complex technical and security challenges.Effective communication skills, including the ability to explain complex technical issues to non‑technical stakeholders and to produce clear technical documentation.Demonstrated ability to work collaboratively in multicultural and cross‑functional teams, building constructive relationships with stakeholders.Strong sense of initiative, ownership and accountability, with a focus on service quality and continuous improvement.High level of integrity, professionalism and discretion in handling sensitive information and systems.Ability to provide technical guidance and mentoring to colleagues and project teams, contributing to the development of organizational capabilities in secure cloud engineering.Proficiency in scripting for security automation and knowledge of SIEM concepts (Desirable).Knowledge of Zscaler SASE architectures and Agile project management methodologies (Desirable).Advanced technical knowledge of the CrowdStrike ecosystem, specifically regarding CrowdStrike's Cloud Security Module (CSPM/CWP), Identity Management and Protection products, and Next‑Gen SIEM capabilities (Desirable).SkillsAWS Certified Solution Architect AssociateCloud SecOps EngineeringAWS Security ServicesAzure SecurityGoogle Cloud SecurityInfrastructure as CodeTerraformCloudFormationContainer SecurityKubernetes SecurityCI/CD Security IntegrationCrowdStrike Endpoint ProtectionIdentity and Access ManagementNetwork SecurityEncryptionCloud Penetration TestingDevOps PracticesSecure Software Development LifecyclePython ScriptingPowerShell ScriptingBash ScriptingSecurity AutomationSIEM ConceptsCloud Security ArchitectureSecurity Strategy ManagementTechnical Documentation ProductionTechnical Guidance and MentoringAgile Project ManagementZscaler SASE ArchitectureLanguagesEnglish, French