Azqore, a next-generation provider of Information Systems and banking operations services, is a subsidiary of Indosuez Wealth Management, the wealth management arm of the Crédit Agricole Group. As a global company, Azqore is committed to providing wealth managers with integrated, turnkey digital solutions.
With its headquarters in Switzerland and its Asia hub in Singapore, Azqore currently serves around thirty clients through its proprietary S2i platform, supporting approximately CHF 200 billion in assets under management.
At the heart of our strategy, we are looking for a Senior Private Cloud Security Engineer in charge of the security engineering of Azqore private-cloud platforms and their workloads, with a primary focus on Virtuozzo Application Platform and Virtuozzo Hybrid Infrastructure. The engineer will establish secure platform patterns, hardening, segmentation, secrets management, observability and audit-ready evidence for regulated workloads..
👨🔧 Your responsibilities
Private-cloud security architecture - Design and maintain the security baseline for VAP/VHI, virtualization or OpenStack-like components. Translate threats and regulatory expectations into practical controls.
Environment isolation - Define secure patterns for DEV, SIM, UAT, EXP and sandbox environments, including tenant separation, administrative boundaries and controlled connectivity.
Network security - Specify and review segmentation, firewall rules, bastion and jump-host access, TLS, DNS and restricted-egress patterns. Apply least connectivity and produce traceable flow documentation.
Platform hardening - Establish CIS-aligned hardening, secure configuration, follow-up of patching, vulnerability management and configuration-drift controls and platform services.
Secrets and service access - Participate in designing Vault namespaces, policies, authentication methods, rotation, TTL and revocation. Secure GitLab JWT and production AppRole patterns. Prevent clear-text secrets in Terraform/Ansible and deployment tooling.
Secure automation - Review and harden centralized Ansible content and IaC. Define code-review, testing, promotion, inventory and credential-handling practices.
Registry and image security - Participate in governance of internal Docker and Nexus registries, approved base images, scanning, SBOM, provenance and promotion of trusted images into private-cloud environments.
Observability and detection - Define security logging and telemetry with ELK/EFK, Open Telemetry and Splunk. Ensure key administrative and security events are detectable and retained.
Operational readiness - Create runbooks, exception handling, incident support, evidence packs and knowledge transfer. Establish ownership with Infrastructure, Network, SOC, IAM, DevOps and application teams.
🧙♂️ Your core competencies
Bachelor Degree in Cybersecurity, Computer Science or equivalent
Minimum 8 years delivery and hands-on security experience with:
Private cloud, Kubernetes, OpenStack, OpenShift, VMware or an equivalent platform.
Linux and container hardening, vulnerability management and secure administration.
Network segmentation, firewalling, bastion patterns, TLS and DNS fundamentals.
HashiCorp Vault or comparable enterprise secrets-management implementation.
GitLab CI/CD and Ansible security, including secure credential patterns.
Container image, registry, SBOM and trusted-base-image governance.
Security logging, SIEM integration and operational evidence.
Ability to create a baseline and drive implementation across several infrastructure owners.
Proven achievements as a hands-on architect-builder who can turn an incomplete requirement into a clear security design, working implementation, evidence, documentation and an operational handover.
Keen to roll up sleeve and do beyond advisory work but also involved in deployment and production support work.
Understands availability, recoverability, change control, audit evidence, operational ownership and supportability.
You are autonomous, tenacious and rigorous. Boredom won't be part of your day, but you need to know how to organize yourself to manage the multiple issues underway.
.jpeg)
