Senior Cloud Security Engineer in Genf

The Senior Cloud Security Engineer serves as the principal technical authority on cloud information security, responsible for defining and executing the security strategy for WIPO's multi-cloud and hybrid environments.

The role ensures resilient and compliant business solutions by embedding security‑by‑design principles into cloud architectures and driving secure adoption of cloud services through standardized patterns, automation guardrails, and advanced protection technologies.

Responsibilities

• Serve as the principal technical authority for secure cloud architecture, designing and validating secure landing zones and reference architectures for AWS and other major public clouds (Azure/GCP).
• Collaborate with the Senior Security Architect to define and maintain security patterns for common workloads, ensuring alignment with WIPO’s policies and industry standards.
• Develop and implement frameworks to detect and remediate architectural drift, ensuring continuous alignment with security baselines.
• Lead the development and maintenance of reusable Infrastructure as Code (Ia C) modules (e. g., Cloud Formation, Terraform) to ensure the secure, repeatable, and auditable provisioning of cloud resources.
• Engineer and maintain automation scripts (Python, Power Shell, Bash) to enhance deployment reliability, security configuration, and operational efficiency.
• Audit Ia C implementations to ensure adherence to best practices and integrate automated security checks and policy enforcement into CI/CD pipelines.
• Implement, document, and operate comprehensive cloud security baselines, including identity and access models (IAM), network segmentation, encryption standards, and secrets management.
• Orchestrate the integration and optimization of Crowd Strike and other cloud‑native security technologies into WIPO’s environments (including containers and serverless), creating associated playbooks and configuration documentation.
• Secure container orchestration platforms (Kubernetes, EKS/AKS/GKE) by implementing image scanning, policy enforcement, and runtime protection measures.
• Collaborate with Application Security (App Sec) and development teams to embed security into the application lifecycle, providing remediation guidance and threat modeling input.
• Refine and apply cloud governance frameworks, including account structures, tagging standards, and guardrails, to ensure compliance with WIPO policies and external standards (e. g., ISO 27001, CIS).
• Develop and maintain comprehensive technical documentation, including architecture diagrams, standard operating procedures (SOPs), and configuration baselines.
• Build organizational capacity by creating technical guidelines and delivering training/awareness sessions to mentor ICT and project teams on secure cloud engineering practices.
• Coordinate with vendors and service providers to ensure external solutions meet WIPO's technical and security requirements.
• Perform other related duties as required.

Requirements

• Advanced university degree in information security, computer science, engineering, mathematics, business, or related discipline.
• A first‑level university degree in a relevant discipline plus two years of relevant experience in addition to the experience requested below may be accepted in lieu of an advanced degree.
• AWS Certified Solution Architect Associate certification.
• AWS Certified Security - Specialty (Desirable).
• Microsoft Certified: Cloud and AI Security Engineer Associate (Desirable).
• SANS SEC588 Cloud Penetration testing (or equivalent) (Desirable).
• SANS SEC540 Cloud Native Security and Dev Sec Ops Automation (or equivalent) (Desirable).
• OSWA Offsec Web Assessor or OSWE Offsec Web Expert (Desirable).
• A minimum of 7 years working in the field of information security in an engineering or analysis capacity.
• At least three years of hands‑on experience in cloud security and engineering, with specific expertise in AWS and at least one other major public cloud platform (Azure or GCP).
• Proven track record in designing, deploying, and operating secure cloud workloads in production environments.
• Demonstrated experience in Infrastructure as Code (Ia C) and automation, specifically using Terraform or Cloud Formation to deploy secure cloud resources.
• Practical experience in securing container orchestration platforms (e. g., Kubernetes, EKS, AKS, GKE) and integrating security controls into CI/CD pipelines.
• Practical experience with endpoint/workload protection tools, including hands‑on experience with the Crowd Strike runtime agent.
• Proven track record of designing and operating security controls in production environments, including identity management (IAM), network security, and encryption.
• Experience working in large, complex, or regulated environments (such as international organizations, the public sector, or the financial industry).
• Experience with advanced Crowd Strike capabilities, including Cloud Security (CSPM/CWP), Identity Management and Protection, and/or Next‑Gen SIEM (Desirable).
• Experience in application security (App Sec), secure software development lifecycles (SSDLC), or Dev Sec Ops practices (Desirable).
• Excellent written and spoken knowledge of English.
• Knowledge of other UN official languages, particularly French (Desirable).
• Deep knowledge of AWS, Azure, or GCP security services and configurations.
• Proficiency in scripting (Python, Power Shell or Bash) and Ia C frameworks (Terraform or Cloud Formation).
• Knowledge of endpoint/workload protection principles and technologies.
• Familiarity with Dev Sec Ops principles, CI/CD pipelines, and security automation.
• Strong analytical, conceptual and problem‑solving skills with the ability to address complex technical and security challenges.
• Effective communication skills, including the ability to explain complex technical issues to non‑technical stakeholders and to produce clear technical documentation.
• Demonstrated ability to work collaboratively in multicultural and cross‑functional teams, building constructive relationships with stakeholders.
• Strong sense of initiative, ownership and accountability, with a focus on service quality and continuous improvement.
• High level of integrity, professionalism and discretion in handling sensitive information and systems.
• Ability to provide technical guidance and mentoring to colleagues and project teams, contributing to the development of organizational capabilities in secure cloud engineering.
• Proficiency in scripting for security automation and knowledge of SIEM concepts (Desirable).
• Knowledge of Zscaler SASE architectures and Agile project management methodologies (Desirable).
• Advanced technical knowledge of the Crowd Strike ecosystem, specifically regarding Crowd Strike's Cloud Security Module (CSPM/CWP), Identity Management and Protection products, and Next‑Gen SIEM capabilities (Desirable).

Skills

• AWS Certified Solution Architect Associate
• Cloud Sec Ops Engineering
• AWS Security Services
• Azure Security
• Google Cloud Security
• Infrastructure as Code
• Terraform
• Cloud Formation
• Container Security
• Kubernetes Security
• CI/CD Security Integration
• Crowd Strike Endpoint Protection
• Identity and Access Management
• Network Security
• Encryption
• Cloud Penetration Testing
• Dev Ops Practices
• Secure Software Development Lifecycle
• Python Scripting
• Power Shell Scripting
• Bash Scripting
• Security Automation
• SIEM Concepts
• Cloud Security Architecture
• Security Strategy Management
• Technical Documentation Production
• Technical Guidance and Mentoring
• Agile Project Management
• Zscaler SASE Architecture
• Languages
• English, French