Cloud Security Engineer (Travel and Transportation) w Wrocław, Polska

Cloud Security Engineer (Travel and Transportation)

Miejsce pracy: Wrocław

Technologies we use

Expected

• Google Cloud Platform
• AWS
• Wiz
• Terraform

Optional

• Python
• Bash
• Cloudflare
• Jira
• Slack

About the project

You will contribute to a large-scale greenfield travel-technology initiative supporting the launch of a new airline operation. The project uses a modern commercial platform to enable flexible retailing, pricing, and digital shopping experiences across travel products and ancillary services.

Our client is a travel technology company developing cloud-native, AI-powered software for airlines and hospitality brands. Its products help customers improve commercial performance, reduce costs, and evolve their digital commerce capabilities. The company’s technology is designed to work alongside existing airline systems, allowing customers to introduce new capabilities without replacing their current technology landscape.

This is how we organize our work

This is how we work

• at the client's site
• you focus on a single project at a time
• you have influence on the technological solutions applied
• agile
• scrum

Your responsibilities

• Own and continuously improve cloud security posture across GCP organizations and AWS accounts, including connector coverage, runtime sensor deployment on production clusters, custom policy development, finding-triage baselines, and integrations with Jira, PagerDuty, and Slack;
• Operate and evolve the edge security layer, centralizing internet-facing protection through Cloudflare WAF, bot management, rate limiting, DNS/TLS, and origin routing for customer-facing production zones;
• Tune security rules using real production traffic, manage allow-list requests, and enable other teams to use edge-security tooling effectively;
• Support and automate vulnerability management and secure configuration, maintaining the intake of Wiz, SAST, penetration-test, and customer-reported findings, defining remediation baselines, and driving owners to closure;
• Participate in security incident response for cloud events, including DDoS and bot attacks, supply-chain alerts, credential exposure, and data-handling incidents, while creating and maintaining detection, triage, and mitigation runbooks;
• Help secure the software supply chain by owning SAST reporting in SonarCloud, dependency scanning with Dependabot, container base-image hardening, and the selection of SBOM and SCA tooling, and publish release-level security reports for engineering teams;
• Produce technical evidence for SOC 2, PCI DSS, ISO 27001, and NIS2, including evidence of log-sink configuration and retention, access reviews, authenticated scanning, and IAM remediation, and map Wiz controls to relevant frameworks to make evidence collection repeatable;
• Enable security self-service by training Platform, CloudOps, and Product Engineering teams on the tools they use, including Wiz and Cloudflare administration, mapping service catalogues to owners, and automating recurring customer-security and issue-triage reporting through scripting and AI-assisted workflows;
• Advise and partner with engineering teams on the security of new platform integrations and AI/RAG services, contributing to the annual cloud-security roadmap and target-state architecture;

Our requirements

• 5+ years of experience in cloud security or platform engineering with a security focus, including hands-on experience with GCP or AWS across IAM, audit logging, log routing, network security, and workload protection;
• Production experience with a CNAPP/CSPM platform, such as Wiz (preferably) / Prisma Cloud / Orca / Google Security Command Center, including policy authoring, integrations, and runtime protection;
• Hands-on administration of a WAF, CDN, and bot-management stack at scale;
• Strong Terraform experience, including building modules for security tooling and WAF configuration, reviewing changes, and managing configuration drift and legacy infrastructure;
• Experience with vulnerability management across cloud infrastructure, containers, and code, including SAST, SCA/dependency scanning, container image hardening, and penetration-test remediation tracking;
• Experience routing cloud security signals to a SIEM or security-monitoring platform, such as Wazuh, Microsoft Sentinel, Google Security Operations, or Datadog Security Monitoring, and integrating actionable alerts with PagerDuty and Slack;
• Scripting skills in Python or Bash for automation and security reporting;
• Security incident-response experience in a production environment, including developing runbooks and managing vendor escalations;
• Clear written and verbal communication skills, with the ability to train engineering teams and document security decisions;

Optional

• Experience automating security workflows, such as report generation and issue triage, with AI-assisted or LLM-based tooling;
• Experience working across both GCP and AWS, experience with Azure;
• Familiarity with Rego, OPA, or other policy-as-code languages;
• Experience with identity and access-management tooling, including Okta SSO/SCIM, PAM solutions, and least-privilege reviews for cloud IAM;
• Experience facilitating OWASP SAMM assessments, threat-modelling sessions, or security-champions programs;
• Airline or travel-industry experience, including PCI-scoped payment flows, partner integrations, and customer-facing security reporting;
• Experience supporting compliance with PCI DSS, SOC 2, ISO 27001, or NIS2;
• Certifications such as Google Professional Cloud Security Engineer, CCSP, or AWS Certified Security – Specialty;

What we offer

• Resources and opportunities for self-education in technical and non-technical areas;
• Access to internal conferences and meetups for knowledge sharing and learning from industry experts;
• Medical insurance;
• Sports activities to promote a healthy lifestyle;
• Flexible work options, including remote and hybrid opportunities;
• Referral program for bringing in new talent.

This is how we work on a project

• issue tracking tools

Development opportunities we offer

• space for experimenting
• substantive support from technological leaders
• technical knowledge exchange within the company

COHERENT SOLUTIONS sp. z o.o.

Coherent Solutions is a digital product engineering company focused on empowering business success. Our global team of 2000 talented professionals collaborates seamlessly to deliver innovative solutions that drive measurable business impact. Headquartered in Minneapolis, USA, the company’s core competencies across 10 locations worldwide include software product development, IT consulting, data and analytics, machine learning, mobile app development, DevOps, Salesforce, and more.

We grow a team of advisors, not just order takers, and strive to make the company a place for career growth and opportunities. If you want to grow your core competencies, share your passion, and be sure every contribution is evaluated, we are on the same page.

Privacy Policy for Job Applicants Last modified: 01/01/2023 As part of the recruitment process at Coherent Solutions Inc and below indicated Coherent Solutions subsidiaries (collectively “Coherent Solutions”, “Coherent”, “we”, “us” or “our”), we collect and process your personal data following the principles of transparency and confidentiality. Therefore, we have prepared this Privacy Policy for Job Applicants (hereinafter “Privacy Policy”) with the purpose of explaining how information about you is collected, used and disclosed depending on the processing purposes described in this Privacy Policy. The principles established by this Privacy Policy are based on European data protection and privacy laws, taking into account the requirements of the EU General Data Protection Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of individuals with regard to the processing of personal data and on the free movement of such data, (hereinafter “GDPR”), California Consumer Privacy Act and California Privacy Rights Act (hereinafter “CCPA/CPRA”), and on applicable local laws.
1. Who is the Data Controller and How to Contact Us Coherent Solutions Inc, together with Coherent Solutions subsidiaries, is the personal data Joint Controller (“Controller”) and is responsible for compliance with the provisions of the GDPR, CCPA/CPRA and applicable local laws. You can exercise any of your rights listed in para. 7 below by contacting us at [email protected]. Coherent Solutions group of companies includes the following companies which act as joint controllers in relation to your personal data: • Coherent Solutions Inc, USA • Coherent Solutions UAB, Lithuania • Coherent Solutions Ltd, Bulgaria • Coherent Solutions Romania SRL, Romania • Coherent ISSoft SRL, Republic of Moldova • Coherent Solutions Sp. z.o.o, Poland • ISsoft Solutions Ukraine Limited Liability Company, Ukraine • Foreign Production Unitary Enterprise ISSOFT SOLUTIONS, Belarus • Coherent Solutions Issoft Georgia LLC, Georgia • Issoft Coherent Solutions Mexico S de RL de CV, Mexico 2. What Personal Data We Collect and Why 2.1 Purpose of processing When you submit your application on our website, we collect, store and process the personal data in your CV. We process this data with the purpose to evaluate your professional skills, and to assess your qualification and experience in relation to current open positions with a view of potential employment as well as to future open positions that may become available. 2.2 Personal data we collect During the recruitment process, we collect, use and store the information which is necessary for the purpose described above. This information includes the following: • Name and Surname (for the purpose of identification of a candidate), • E-mail address and telephone number (for the purpose to contact a candidate), • CV, resume, cover letter and other attachments you provide to us, like certificates, diplomas, recommendation (for the purpose to get relevant information about your educational background and professional skills), Job position you have applied for (for the purpose to direct your CV to the relevant recruiter), • Link to LinkedIn profile, GitHub profile, if any (for the purpose of collecting more relevant information about your professional experience), • Name of a referee in the Company, if any (for the purpose of a Corporate Referral Program), Interview notes about candidate (for the purpose of a proper assessment of professional experience and skills), • Notes of a candidate from recruitment agency (for the purpose of a proper candidate’s assessment in case external recruitment agency is engaged), • Testing task results (for the purpose of a proper evaluation of candidate’s performance and skills), • Desired salary and other job-related preferences (for the purpose of understanding the candidate’s expectations and suitability for the open position), • Relevant information about the candidate, which is publicly available on the Internet, • Other information, which is provided by job applicants on a voluntary basis. You are not obliged to provide us with the personal information as listed above. However, if you refuse to submit us all necessary information, we will not be able to evaluate your candidacy for the open vacancy and, consequently, will not be able to proceed with your potential employment with us. 2.3 Please, note, that we do not require and do not collect any sensitive categories of personal data, as defined under Art. 9 GDPR, which includes racial or ethnic origin, political opinions, religious or philosophical beliefs, or trade union membership, and the processing of genetic data, biometric data for the purpose of uniquely identifying a natural person, data concerning health or data concerning a natural person’s sex life or sexual orientation. 3. What is the Legal Ground for Collecting Your Personal Data When collecting and processing your personal data, we rely on one of the following legal grounds as stated below. • When candidate is submitting a CV to us, expressing the interest in potential employment in the Company, we process CV application relying on a legitimate interest legal basis (Art. 6.1 (f)). • When storing information about the candidate and contacting about future relevant job openings within 3 (three) years after receiving CV, we rely on a consent (Art. 6.1 (a)), in order to give the candidate the possibility to work with us in the future, even though currently we are unable to make a job offer. • When a candidate has submitted to us additional informational voluntary, we store and process information on a consent legal basis (Art.6.1 (a)). • When processing is based on a legitimate interest (Art.6.1 (f)) in case: • we contact you via LinkedIn or other professional networks with an information about our open positions, • you get involved in a dispute with us or we otherwise need to defend, enforce, exercise, and uphold our rights. • When processing is necessary for compliance with legal obligations (Art. 6.1 (c)) in case we receive a data subject request, or you decided to object contacting you with information about new job openings. 4. With Whom We Share Your Personal Data 4.1 Within Coherent Solutions group As Coherent Solutions group of companies consists of many different subsidiaries, we may share your personal data across companies in the Coherent Solutions group of companies, as listed in para. 1 above. Data sharing within the group of our companies is conditioned by decentralized organizational structure of business functions in the field of recruiting and is necessary to support ongoing business activities and to achieve business continuity. 4.2 Outside Coherent Solutions group We can also share your personal data with the following categories of external recipients only to the extent permitted by law and if necessary for the purposes described in para. 2.1 above: • maintenance and technical services, IT security and communications services for the purpose to protect the security and confidentiality of personal data we process and to help make our services available and functional, • attorneys, attorney assistants, legal advisors for the purpose to defend, enforce, exercise, and uphold our rights if you get involved in a dispute with us, • recruiting agencies in case such agencies assist us with recruiting process, • clients and their representatives in case evaluation and/or approval of your candidacy for the open position by client is necessary due to job-related functions, • academic institutions, former employer, referee with a purpose to verify your educational background, professional experience or to get a recommendation about you, • supervisory authority, government departments and agencies, police, regulators, courts in case we are legally obliged to share your personal data. 4.3 Outside EEA Some of the external recipients may be established outside the European Economic Area, which may result in your data being transferred to third countries. We share your personal data with recipients outside the EEA only when this is permitted by law and is necessary for the purposes outlined in para. 2.1 above. In this case you can expect the same level of protection of your personal data, since we ensure that any external data recipient that we engage with has adopted adequate data protection and security measures to safeguard your personal data. 5. How Long We Keep Your Personal Data We only retain your personal data for as long as necessary for the recruiting process. If you have become an employee, we will retain your application information along with other personal data required by local legislation to enter an employment relationship with us. In this case, your personal data will be stored during the employment period and after 5 (five) years after the employment contract termination unless a longer period is established in the applicable local law. If you have not been selected for the applied position, we will store your application information: • for a period of 6 (six) months after the last interaction with you, unless another period is established by local law, for the purpose of preparation, filing or defense of legal claims, • for a period of 3 (three) years since the application date with a purpose to contact you about future openings unless you object contacting you for this purpose. You can object contacting you about future job openings anytime by contacting us via [email protected]. In this case we will not contact you about future open positions. 6. Security of Your Personal Data When collecting, processing and storing your personal data, the Company is committed to the principles of integrity and confidentiality. Therefore, we take all reasonable technical and organizational measures to ensure that the personal data you are providing to us is in secure. The Company imposes the same obligations on external data processors outside the EEA, including on Greenhouse Software, Inc, recruitment software service provider, by signing a proper Data Processing Agreement. 7. What are Your Privacy Rights According to the General Data Protection Regulation, you have the following rights in relation to personal data you have submitted to us: • Right to information. You may at any time request from us information about what categories of your personal data we store and for what purposes (Art. 15 of GDPR) • Right of consent withdrawal. If you have provided us with your consent to process your personal data, you can withdraw your consent at any time without giving any reasons. Withdrawal of the consent shall not affect the lawfulness of the processing of personal data based on the consent before its withdrawal. (Art. 7 of GDPR). • Rectification right. If your personal data processed by Coherent Solutions is incorrect (inaccurate), you can ask us to correct it at any time (Art. 16 of GDPR). • Erasure and restriction of processing rights. You have the right to obtain the deletion of your personal data that Coherent Solutions processes or obtain restriction of processing. Deletion can be done at any time by contacting us. If deletion is due to legitimate reasons, instead of deletion, only restriction of your data may take place (Art. 17 and 18 of GDPR). After deleting your data, it is no longer possible for us to recover it. • Right to data portability. If you require us to provide you with your personal data, we will transfer the data to you or another controller in a structured, widely used and machine-readable format (Art. 20 of GDPR). • Right of objection. You have the right at any time and without giving any reason to object to our processing of your data (Art. 21 of GDPR). If you decide to object us to processing your personal data, we will no longer be able to proceed with your job application. • Advanced rights in automated data processing, including profiling. Coherent Solutions does not perform automated data processing, including profiling. Notwithstanding the above, with respect to automated data processing, including profiling, you have the additional right to request human intervention from the Controller, the right to challenge the decision and the right to express your point of view (Art. 22 of GDPR). We will respond to all your requests related to the implementation of your, as the data subject, rights without undue delay and no later than within 1 (one) month after receiving the request. That period may be extended by 2 (two) further months by informing you in advance. You also have the right to lodge a complaint with a supervisory authority against the processing of personal data if you believe that your personal data protection rights have been violated. 8. Contact details If you have any questions about collection, processing and storage of your personal data as a part of recruitment process, or regarding exercising your rights, please contact our Data Protection Officer at [email protected]. You can also send the request to the address: Coherent Solutions Inc 1600 Utica Ave S, Ste 120 Minneapolis MN 55416, USA Attention: DPO Coherent Solutions UAB Konstitucijos ave. K29, Vilnius, 08105, Republic of Lithuania Attention: DPO 9. Changes to this Privacy Policy The Company reserves the right to update this Privacy Policy for Job Applicants. The updated version of this Privacy Policy will be made available by publishing on a website.