Mainframe Security Engineer / Specialist

Role Summary

We are looking for an experienced Mainframe Security Engineer / Specialist to support the administration, governance, security, compliance, and protection of enterprise IBM Z environments. The role requires strong hands-on expertise in RACF or equivalent Mainframe security products, identity and access management, security administration, audit/compliance, vulnerability remediation, and security automation.

The individual will work closely with Mainframe infrastructure, application, operations, IAM, cybersecurity, audit, and compliance teams to ensure secure and compliant operation of business-critical Mainframe platforms.

1. Administer, configure, maintain, and support Mainframe security environments, primarily IBM RACF, or equivalent products such as ACF2 and Top Secret.

2. Manage user IDs, groups, roles, profiles, permissions, access controls, and security policies across z/OS environments.

3. Perform RACF administration, including management of users, groups, dataset profiles, general resource profiles, password/passphrase policies, and access permissions.

4. Implement and maintain appropriate access control and least-privilege principles for Mainframe users, applications, service accounts, and privileged IDs.

5. Manage security requirements across key Mainframe components including z/OS, TSO/ISPF, USS, JES2, CICS, Db2, IMS, MQ, and storage, depending on the environment.

6. Support identity and access management processes, including access provisioning, modification, revocation, periodic access reviews, and recertification.

7. Monitor and investigate Mainframe security events using SMF records, RACF reports, system logs, audit reports, and security-monitoring tools.

8. Support security audits, regulatory compliance assessments, risk assessments, vulnerability reviews, and remediation activities.

9. Review and remediate security findings arising from internal audits, external audits, penetration assessments, vulnerability scans, and security health checks.

10. Support management of privileged and elevated access, including emergency IDs and privileged-account controls.

11. Review and strengthen Mainframe security configurations in line with organisational security policies and applicable security baselines and industry standards.

12. Support integration of Mainframe security with enterprise IAM, PAM, MFA, SIEM, authentication, certificate, and security-monitoring solutions.

13. Manage and troubleshoot digital certificates, key rings, TLS/SSL configurations, encryption-related security controls, and authentication mechanisms where applicable.

14. Develop and maintain REXX, JCL, CLIST, or other automation for security administration, reporting, monitoring, and repetitive operational activities.

15. Participate in incident, problem, change, vulnerability, security-event, and risk-management processes related to Mainframe platforms.

16. Maintain security documentation, SOPs, access-control procedures, audit evidence, compliance records, configuration documentation, and operational runbooks.

17. Collaborate with Mainframe system programmers, application teams, IAM, SOC, cybersecurity, audit, compliance, network, database, and infrastructure teams.

18. Identify opportunities for security automation, continuous compliance, enhanced monitoring, access optimisation, and security modernisation across the Mainframe platform.

Required Technical Skills

1. Strong hands-on knowledge of IBM RACF or equivalent Mainframe security products such as Broadcom ACF2 / Top Secret

2. RACF user, group, dataset, and general resource administration

3. RACF commands and utilities, including security administration and reporting

4. Strong understanding of z/OS security architecture and access-control concepts

5. TSO/ISPF and JCL

6. Knowledge of z/OS UNIX / USS security

7. Understanding of security requirements for CICS, Db2, IMS, MQ, JES2, or similar Mainframe subsystems

8. SMF security records, audit reporting, logging, and security-event analysis

9. Identity and Access Management (IAM) concepts, including provisioning, de-provisioning, access reviews, and recertification

10. Privileged Access Management (PAM) and privileged-ID security concepts

11. Knowledge of digital certificates, key rings, TLS/SSL, encryption, and authentication

12. REXX / CLIST / JCL scripting and security automation

13. Security incident, vulnerability, risk, and change management

14. Strong troubleshooting and root-cause-analysis skills

15. Understanding of least privilege, segregation of duties, privileged access, and security governance

Preferred Skills

Exposure to one or more of the following would be advantageous:

1. Broadcom ACF2 or Top Secret (TSS)

2. Mainframe security assessment and compliance tools

3. IBM zSecure for security administration, reporting, auditing, and compliance

4. Enterprise IAM and PAM platforms

5. SIEM integration and Mainframe security-event monitoring

6. CICS, Db2, IMS, IBM MQ security administration

7. Mainframe network security including TCP/IP, AT-TLS, TLS/SSL, and Communications Server

8. PKI, digital certificates, cryptography, ICSF, and key-management concepts

9. Security standards and frameworks such as CIS benchmarks, NIST, ISO 27001, PCI DSS, and organisational security baselines, where applicable

10. Security audit, compliance, risk-management, and vulnerability-remediation processes

11. Ansible, Python, Git, REST APIs, or DevOps/SecOps automation in a Mainframe environment

12. Integration of IBM Z security with distributed, cloud, IAM, PAM, and security-monitoring platforms

13. Mainframe security modernisation, Zero Trust, MFA, passwordless authentication, and automated compliance concepts

Experience

1. Relevant hands-on experience in Mainframe security administration, RACF engineering, IAM, cybersecurity, or IBM Z infrastructure security.

2. Experience supporting business-critical enterprise Mainframe environments with strong security and availability requirements.

3. Experience administering RACF, ACF2, or Top Secret in enterprise z/OS environments.

4. Experience supporting user access management, privileged access, security controls, audit, compliance, and remediation activities.

5. Experience working within structured ITIL-based Incident, Problem, Change, and Release Management processes.

6. Experience collaborating with cybersecurity, IAM, audit, risk, compliance, Mainframe infrastructure, and application teams.

Desired Profile

1. Strong analytical, security, and problem-solving capability.

2. Ability to independently investigate and troubleshoot complex Mainframe security and access-control issues.

3. Strong understanding of security governance, least privilege, segregation of duties, and access-control principles.

4. Good written and verbal communication skills, particularly for technical documentation, audit responses, and stakeholder communication.

5. Comfortable working with global delivery, Mainframe infrastructure, cybersecurity, application, IAM, audit, compliance, and vendor teams.

6. Strong focus on security, compliance, risk reduction, documentation, automation, and continuous improvement.

7. Ability to balance stringent security controls with business availability and operational requirements.