MTA - Cloud Security Engineer

McKesson is in the business of better health, and we touch the lives of patients in virtually every aspect of healthcare. We partner with payors, hospitals, physician offices, pharmacies, pharmaceutical companies, and others across the spectrum of care to build healthier organizations that deliver better care to patients in every setting. We believe in the importance of strong, vital organizations because we know that patients can only be healthy when our system is healthy.

Every single McKesson employee contributes to our mission—by joining McKesson you act as a catalyst in a chain of events that helps millions of people all over the globe. Talented, compassionate people are the future of our company—and of healthcare. At McKesson, you’ll collaborate on the products and solutions that help us carry out our mission to improve lives and advance healthcare. Working here is your opportunity to shape an industry that’s vital to us all.

We understand the importance of a system that works together. Your expertise drive and passion can help us improve everything we touch, from providers to payors to pharmacies. Join our team of leaders to begin a rewarding career.

As a Cloud Security Engineer, you will be responsible for designing, implementing, and managing robust cloud security solutions and controls. You will work closely with Cloud Engineering and DevOps teams to integrate security practices into the CI/CD pipeline and ensure the security of our hybrid cloud environment. Your expertise in cloud security tools, controls, Kubernetes, and DevOps will be essential in maintaining a secure and efficient infrastructure.

Responsibilities:

• Security Integration in SDLC:

• Collaborate with development teams to integrate security best practices into all phases of the Software Development Life Cycle (SDLC).

• Implement and manage security automation tools (e.g., IAC Scanning) within the CI/CD pipeline.

• Advise on secure configuration practices including container security, and cloud native authentication.

• Automate security testing, monitoring, and reporting processes using industry-standard tools and frameworks.

• Contribute to infrastructure as code (IaC) repos and support templating/blueprints for standard deployments.

• Support integrations between security tooling with ServiceNow and/or Jira and CMDB tooling

Vulnerability Management:

• Monitor and analyze security incidents and vulnerabilities reported by various sources, including threat intelligence feeds.

• Leverage scripting and automation to quickly analyze and operationalize security findings

• Work closely with development and operations teams to prioritize and remediate vulnerabilities in a timely manner.

• Evaluate emerging cloud threats to ensure the implementation of cutting-edge security measures

Compliance and Reporting:

• Ensure all development activities comply with the organization’s security policies and standards, and other relevant cybersecurity frameworks and regulations.

• Develop and maintain security documentation, including security policies, procedures, and guidelines.

• Prepare detailed reports on security findings, incidents, and remediation efforts for stakeholders and leadership.

Minimum Requirements:

4+ years of experience in Cloud Security, Infrastructure Engineering, or related security engineering field.

1+ years of hands-on experience with DevSecOps practices and tools, such as Terraform, Bicep, or Cloud Formation.

BA/BS degree in Computer Science, Engineering, IT or equivalent experience

Technical Skills:

• Proficiency in scripting/programming languages such as Python.

• Experience with CSPM tools such as Wiz, Prisma Cloud, Aqua Security, etc.

• Knowledge of CI/CD tools like GitHub Actions, Jenkins, GitLab CI, or Azure DevOps.

• Knowledge of containerization technologies (Docker, Kubernetes) and cloud security (AWS, Azure, GCP).

Soft Skills:

• Strong problem-solving skills and the ability to think critically about security challenges.

• Excellent communication skills, with the ability to explain complex security concepts to non-technical stakeholders.

• Ability to work collaboratively in a fast-paced, team-oriented environment.

Additional Knowledge & Skills:

• Self-motivated

• Critical Thinking

• Accountable

• Drives results

• Team player

• Knowledge of healthcare, privacy, and financial compliance regulations

• Strong analytical and troubleshooting skills with an understanding of IT business operations and information security