Security Engineer - Modernization & Hybrid Cloud

About the role

Kyndryl is hiring a Security Consultant (titled Security Engineer in the listing) in Lima to protect organizations' data and systems as they migrate to the cloud. The consultant works with clients to assess their security posture, design and implement security controls, and collaborate with cross-functional teams on secure IT infrastructure, applications and vendors.

Key responsibilities

• Define the security blueprint for coexistence and migration phases, applying "security by design" to Java microservices and cloud-native databases.
• Design secure integration between Mainframe Security (RACF) and cloud identity providers (Azure AD/Entra ID) under Zero Trust principles.
• Implement SAST, DAST and SCA in the CI/CD pipeline for high-concurrency Java applications.
• Define encryption, masking and tokenization for DB2 and VSAM data moving to cloud databases (PostgreSQL/SingleStore).
• Evaluate the performance impact of security controls such as encryption, firewall latency and mTLS.
• Configure and audit Azure security posture, including Network Security Groups, Key Vaults and Private Links.
• Enforce API gateway security with OAuth2/OIDC and protection against OWASP Top 10 threats.
• Set up logging and monitoring (SIEM/SOAR) correlating legacy batch processes with modern distributed traces.
• Mentor development squads and act as a bridge between security requirements and cloud migration.

Required profile

• At least 4-5 years of experience in hybrid infrastructure and legacy security.
• Deep understanding of RACF (or ACF2/Top Secret) and experience securing data extraction from DB2 and VSAM during migration.
• Experience hardening Azure services (AKS, Azure SQL, Key Vault, Azure Firewall) and configuring PostgreSQL and SingleStore, including row-level security.
• Ability to balance security with performance in high-volume banking transactions.

Required skills

• Secure protocols: AT-TLS, SSH tunneling, SFTP/FTPS.
• Spring Security, JVM security, and secure coding guidance for COBOL.
• DevSecOps with Checkmarx, SonarQube and Snyk.
• Cryptography: AES-256, RSA, ECC, and HSM integration.

The role is part of the Kyndryl Consultant Profession, with learning, training and career growth support. The position is described as hybrid-friendly.