Senior Security Risk Engineer (Continuous Risk Identification, Operational Security)

About the team

Build risk intelligence and automation at Oracle, connecting security evidence to identify exposure and drive measurable risk reduction.

Description

Oracle Security & GRC is seeking a Senior Security Risk Engineer to help build and scale our approach to security risk intelligence and automation.

Our teams hold valuable information across security assessments, audits, incidents, supplier monitoring and recovery testing. This role will connect that information and build dependable capabilities that help us understand exposure, evaluate control effectiveness and identify where action will make the greatest difference.

Working alongside risk analysts, security engineers and program owners, you will design and deliver integrations, data pipelines, analytical tools and automated workflows. Initial priorities include supplier intelligence, control-health analysis, reuse of resiliency evidence and supplier onboarding automation.

You will help shape an evolving engineering capability, taking practical ideas from proof of concept through to supported operation. Success means better visibility of material exposure, earlier identification of recurring weaknesses, less manual evidence gathering and clearer evidence that action has reduced risk.

This role suits an engineer who combines strong software and data skills with security judgment, curiosity and the ability to turn an ambiguous problem into a useful, maintainable solution.

Responsibilities

• Design, build and maintain integrations and data pipelines that collect, normalise and connect security, compliance, supplier and resiliency information from APIs, enterprise platforms and operational systems.
• Develop repeatable analysis that identifies control gaps, recurring weaknesses, shared dependencies and material changes in exposure.
• Work with risk analysts and domain specialists to translate risk scenarios and expected control outcomes into practical data models, analytical methods and monitoring capabilities.
• Build workflows that connect risk signals to validation, accountable ownership, decisions, remediation and evidence of closure.
• Engineer supplier intelligence and onboarding capabilities that support proportionate triage, assessment reuse, investigation and timely escalation.
• Connect incident, recovery-test and service evidence to help identify resiliency gaps and dependencies across teams and services.
• Preserve source traceability and make data coverage, freshness, quality and analytical confidence visible so that conclusions can be assessed and challenged.
• Develop tools and reporting that explain what has changed, why it matters and what action or decision is needed.
• Apply automation and, where appropriate, AI-assisted techniques to evidence extraction, enrichment and analysis, with validation and human review proportionate to the use case.
• Take prototypes into reliable operation through secure design, appropriate access controls, testing, monitoring, documentation and clear support arrangements.
• Collaborate across security engineering, compliance automation, risk, resiliency and business teams to reuse existing capabilities and deliver solutions that scale.
• Measure the impact of delivered capabilities through improved coverage, reduced manual effort, faster analysis and demonstrable support for risk reduction.

Qualifications

Minimum Job Qualifications
Education and/or Experience:

8 years of experience in IT security (e.g., cloud, endpoint, logging), vulnerability and risk assessment, identity and access management, compliance, a related field

OR

Bachelor's Degree in Computer Science, Information Technology, Computer Security, Engineering, or related field AND 4 years of experience in IT security (e.g., cloud, endpoint, logging), vulnerability and risk assessment, identity and access management, compliance, or related field

OR

Master's Degree in Computer Science, Information Technology, Computer Security, Engineering, or related field. AND 2 years of experience in IT security (e.g., cloud, endpoint, logging), vulnerability and risk assessment, identity and access management, compliance, or related field.

Job Skills:

Same skills as proir level plus;

Incident Management and Response Demonstrated ability in or knowledge of incident management and response, including timely handling and escalation of incidents to minimize business impact.

Security Operations Services Demonstrated experience providing security monitoring, incident detection, and response services.

Scripting Languages Demonstrated ability in or knowledge of scripting languages, including writing and maintaining scripts to improve system efficiency.

Security Architecture Principles Demonstrated ability to apply security architecture principles to build and manage secure environments.

Cloud Security Demonstrated ability in or knowledge of cloud security, including protecting cloud infrastructure and data using risk management frameworks.

Cryptography Demonstrated ability in or knowledge of cryptography, including applying encryption techniques and ensuring secure communications.

Machine Identity Security Demonstrated skill in deploying and managing machine identity security and PKI solutions.

Security Investigation Demonstrated ability in or knowledge of security investigation, including assessing threats and vulnerabilities and enhancing security practices.

Security Assessment Demonstrated ability in or knowledge of security assessment, including conducting and interpreting vulnerability and risk analyses.

Cybersecurity and Privacy Principles Demonstrated ability in or knowledge of cybersecurity and privacy principles, including applying best practices and regulations for data protection.

Preferred Job Qualifications
Education and/or Experience:

8 years of experience in IT security (e.g., cloud, endpoint, logging), vulnerability and risk assessment, identity and access management, compliance, or related field

OR

Bachelor's Degree in Computer Science, Information Technology, Computer Security, Engineering, or related field AND 4 years of experience in IT security (e.g., cloud, endpoint, logging), vulnerability and risk assessment, identity and access management, compliance, or related field

OR

Master's Degree in Computer Science, Information Technology, Computer Security, Engineering, or related field AND 2 years of experience in IT security (e.g., cloud, endpoint, logging), vulnerability and risk assessment, identity and access management, compliance, or related field.

Cloud or Internet Software Security Experience:

2 years of experience working on projects related to cloud or internet software security.

Programming/Scripting Experience:

2 years of experience working with one or more of the following programming or scripting languages (e.g., Go, Java, Python, or C/C++).