Senior Cloud Security Engineer

WIPO Headquarters, 34, chemin des Colombettes, 1211 Geneva 20, Switzerland (GE020)

IMPORTANT NOTICE REGARDING APPLICATION DEADLINE: please note that the deadline for applications is indicated in local time as per the time zone of the applicant’s location.

a. Organizational Setting

This post is located in the Security and Information Assurance Division (SIAD). This Division is responsible for the management of all aspects of WIPO's information and physical security and safety and ensures that appropriate policies and procedures are in place and effective measures and controls are established to assess and mitigate threats/risks to the Organization. In particular, the Division defines the controls for the implementation of information security technologies and monitors if adequate assurance is maintained over WIPO's information assets. The Division also provides professional safety and security services for WIPO staff, its delegates and visitors and ensures the protection of the Organization's facilities and assets. Appropriate balance of the roles between "service" and "control" is the key for its success in enabling and sustaining WIPO's operations in an environment with increasing demands for openness and connectivity on the one hand and rapidly evolving information security risks on the other hand.

b. Purpose Statement

Serving as the principal technical authority on cloud information security, the incumbent is responsible for defining and executing the security strategy for WIPO's multi-cloud and hybrid environments. This role ensures that the Organization's business solutions are resilient and compliant by embedding security-by-design principles directly into cloud architectures in close collaboration with the Architectural Solutions Groups. The incumbent drives the secure adoption of cloud services by establishing standardized patterns, automation guardrails, and advanced protection technologies, thereby enabling application teams to innovate efficiently while maintaining a robust security posture against evolving threats.

c. Reporting Lines

The incumbent works under the supervision of the Head of the Information Security Section.

d. Work Relations

The incumbent works closely with peers within the division and collaborates across the Organization with colleagues from the Cloud Centre of Competence, Business Applications and Architectural Solutions Group.

The incumbent will perform the following principal duties:

a. Secure Cloud Architecture and Design:

Serve as the principal technical authority for secure cloud architecture, designing and validating secure landing zones and reference architectures for AWS and other major public clouds (Azure/GCP).

Collaborate with the Senior Security Architect to define and maintain security patterns for common workloads, ensuring alignment with WIPO’s policies and industry standards.

Develop and implement frameworks to detect and remediate architectural drift, ensuring continuous alignment with security baselines.

b. Infrastructure as Code (IaC) and Automation:

Lead the development and maintenance of reusable Infrastructure as Code (IaC) modules (e.g., CloudFormation, Terraform) to ensure the secure, repeatable, and auditable provisioning of cloud resources.

Engineer and maintain automation scripts (Python, PowerShell, Bash) to enhance deployment reliability, security configuration, and operational efficiency.

Audit IaC implementations to ensure adherence to best practices and integrate automated security checks and policy enforcement into CI/CD pipelines.

c. Cloud Security Controls and Tooling Integration:

Implement, document, and operate comprehensive cloud security baselines, including identity and access models (IAM), network segmentation, encryption standards, and secrets management.

Orchestrate the integration and optimization of CrowdStrike and other cloud-native security technologies into WIPO’s environments (including containers and serverless), creating associated playbooks and configuration documentation.

Secure container orchestration platforms (Kubernetes, EKS/AKS/GKE) by implementing image scanning, policy enforcement, and runtime protection measures.

Collaborate with Application Security (AppSec) and development teams to embed security into the application lifecycle, providing remediation guidance and threat modeling input.

d. Governance, Compliance, and Knowledge Management:

Refine and apply cloud governance frameworks, including account structures, tagging standards, and guardrails, to ensure compliance with WIPO policies and external standards (e.g., ISO 27001, CIS).

Develop and maintain comprehensive technical documentation, including architecture diagrams, standard operating procedures (SOPs), and configuration baselines.

Build organizational capacity by creating technical guidelines and delivering training/awareness sessions to mentor ICT and project teams on secure cloud engineering practices.

e. Other Duties:

Coordinate with vendors and service providers to ensure external solutions meet WIPO's technical and security requirements.

Perform other related duties as required.

Education (Essential)

Advanced university degree in information security, computer science, engineering, mathematics, business, or related discipline.

A first-level university degree in a relevant discipline plus two years of relevant experience in addition to the experience requested below may be accepted in lieu of an advanced degree.

AWS Certified Solution Architect Associate certification.

Education (Desirable)

AWS Certified Security - Specialty
Microsoft Certified: Cloud and AI Security Engineer Associate.
SANS SEC588 Cloud Penetration testing (or equivalent)
SANS SEC540 Cloud Native Security and DevSecOps Automation. (or equivalent)
OSWA Offsec Web Assessor or OSWE Offsec Web Expert.

s