Principal Cloud Security Architect (Remote)

Job Summary:

At iHerb, we are on a mission to make health and wellness accessible to everyone globally through our
products and platforms. The Infrastructure Engineering team at iHerb focuses on improving our
infrastructure, scalability, performance, reliability, and security of the systems and tools for our technology
teams. We provide a wide range of services internally to our teams. Infrastructure Engineering teams
comprises Cloud Operations (CloudOps), Site Reliability Engineering (SRE), Network Engineering
(NetEng), and Production Operations (ProdOps).

The Principal Cloud Security Engineer/Architect is developing and implementing an extensive and well
defined cloud security architecture. Ensure that our security standards are meeting and exceeding cloud
security best practices. Lead our cloud security strategy, drive remediation with cloud security tooling,
optimize cloud architecture and design, and work cross functionally to define new security capabilities.
Partner with teams across the organization to deliver company-wide security initiatives, and respond to
current and emerging cloud security threats.

Job Expectations:

● Define, build, and maintain cloud security policies, standards, and procedures that meet or
exceed all regulatory requirements.
● Implement commercial and vetted open-source solutions to continuously secure and monitor
AWS cloud infrastructure, services, and workloads.
● Collaborate with multiple teams, to drive remediation of vulnerabilities.
● Lead cross-functional projects and establish cloud infrastructure security best practices.
● Research emerging threats, determine applicability, and proactively implement mitigations.
● Participate and be available on-call for security incident response.
● Function as a Cloud Security SME, providing guidance on implementation of new cloud security
technologies and initiatives.

Knowledge, Skills and Abilities:

● Knowledge and familiarity with common security frameworks such as NIST CyberSecurity, CIS,
and CSA.
● Knowledge and ability to implement and operationalize the AWS Security Pillar of the AWS Well
Architected Framework.
● In-depth experience working with AWS services and securing AWS services such as VPC, EC2,
S3, Lambda, Datastore offerings, etc.
● Strong knowledge of AWS (Amazon Web Services) (preferred), GCP (Google Cloud Platform),
Azure (Microsoft), or other cloud platforms and related technologies is strongly desired.
● Experience with Content Delivery Networks (CDN), Web Application Firewall (WAF), Bot
Management and Distributed Denial of Service (DDOS) tooling.

● Knowledge of new and emerging attacker tools, tactics and techniques (TTP) that may pose
threats to the organization.
● Experience with compliance requirements such as PCI, SOX, and GDPR.
● Understanding of cloud network security design including segmentation, encryption, logging,
monitoring, and remediation.
● Strong work ethic, including consistent documentation and tracking of work activities.
● Ability to work in a fast paced, rapidly changing environment with a strong desire to learn.
● You are a self-starter and require minimal guidance to produce results.
● Excellent problem solving, critical thinking, collaboration and communication skills.
● Prioritizes and adjusts tasks to accomplish project results.

The duties and responsibilities described above may provide only a partial description of this position.
This is not an exhaustive list of all aspects of the job. Other duties and responsibilities not outlined in this
document may be added as necessary or desirable, with or without notice.

Experience Requirements:

8+ years of experience securing enterprise-scale cloud infrastructure, software, and services.
Education Requirements:
Bachelor’s degree in Computer Science, Information Technology, or related field. (Masters preferred)
Desired advanced industry certifications: AWS Solutions Architect, AWS Security Specialty, CCSP, CKS,
or SANS GIAC.

#LI-JC1