Administrator (Support & Operations)

Job Summary

Mainframe Security Engineer / Specialist

Role Summary

We are looking for an experienced Mainframe Security Engineer / Specialist to support the administration, governance, security, compliance, and protection of enterprise IBM Z environments. The role requires strong hands-on expertise in RACF or equivalent Mainframe security products, identity and access management, security administration, audit/compliance, vulnerability remediation, and security automation.

The individual will work closely with Mainframe infrastructure, application, operations, IAM, cybersecurity, audit, and compliance teams to ensure secure and compliant operation of business-critical Mainframe platforms.

Key Responsibilities

• Administer, configure, maintain, and support Mainframe security environments, primarily IBM RACF, or equivalent products such as ACF2 and Top Secret.

• Manage user IDs, groups, roles, profiles, permissions, access controls, and security policies across z/OS environments.

• Perform RACF administration, including management of users, groups, dataset profiles, general resource profiles, password/passphrase policies, and access permissions.

• Implement and maintain appropriate access control and least-privilege principles for Mainframe users, applications, service accounts, and privileged IDs.

• Manage security requirements across key Mainframe components including z/OS, TSO/ISPF, USS, JES2, CICS, Db2, IMS, MQ, and storage, depending on the environment.

• Support identity and access management processes, including access provisioning, modification, revocation, periodic access reviews, and recertification.

• Monitor and investigate Mainframe security events using SMF records, RACF reports, system logs, audit reports, and security-monitoring tools.

• Support security audits, regulatory compliance assessments, risk assessments, vulnerability reviews, and remediation activities.

• Review and remediate security findings arising from internal audits, external audits, penetration assessments, vulnerability scans, and security health checks.

• Support management of privileged and elevated access, including emergency IDs and privileged-account controls.

• Review and strengthen Mainframe security configurations in line with organisational security policies and applicable security baselines and industry standards.

• Support integration of Mainframe security with enterprise IAM, PAM, MFA, SIEM, authentication, certificate, and security-monitoring solutions.

• Manage and troubleshoot digital certificates, key rings, TLS/SSL configurations, encryption-related security controls, and authentication mechanisms where applicable.

• Develop and maintain REXX, JCL, CLIST, or other automation for security administration, reporting, monitoring, and repetitive operational activities.

• Participate in incident, problem, change, vulnerability, security-event, and risk-management processes related to Mainframe platforms.

• Maintain security documentation, SOPs, access-control procedures, audit evidence, compliance records, configuration documentation, and operational runbooks.

• Collaborate with Mainframe system programmers, application teams, IAM, SOC, cybersecurity, audit, compliance, network, database, and infrastructure teams.

• Identify opportunities for security automation, continuous compliance, enhanced monitoring, access optimisation, and security modernisation across the Mainframe platform.

Skill Requirements

Required Technical Skills

• Strong hands-on knowledge of IBM RACF or equivalent Mainframe security products such as Broadcom ACF2 / Top Secret

• RACF user, group, dataset, and general resource administration

• RACF commands and utilities, including security administration and reporting

• Strong understanding of z/OS security architecture and access-control concepts

• TSO/ISPF and JCL

• Knowledge of z/OS UNIX / USS security

• Understanding of security requirements for CICS, Db2, IMS, MQ, JES2, or similar Mainframe subsystems

• SMF security records, audit reporting, logging, and security-event analysis

• Identity and Access Management (IAM) concepts, including provisioning, de-provisioning, access reviews, and recertification

• Privileged Access Management (PAM) and privileged-ID security concepts

• Knowledge of digital certificates, key rings, TLS/SSL, encryption, and authentication

• REXX / CLIST / JCL scripting and security automation

• Security incident, vulnerability, risk, and change management

• Strong troubleshooting and root-cause-analysis skills

• Understanding of least privilege, segregation of duties, privileged access, and security governance

Preferred Skills

Exposure to one or more of the following would be advantageous:

• Broadcom ACF2 or Top Secret (TSS)

• Mainframe security assessment and compliance tools

• IBM zSecure for security administration, reporting, auditing, and compliance

• Enterprise IAM and PAM platforms

• SIEM integration and Mainframe security-event monitoring

• CICS, Db2, IMS, IBM MQ security administration

• Mainframe network security including TCP/IP, AT-TLS, TLS/SSL, and Communications Server

• PKI, digital certificates, cryptography, ICSF, and key-management concepts

• Security standards and frameworks such as CIS benchmarks, NIST, ISO 27001, PCI DSS, and organisational security baselines, where applicable

• Security audit, compliance, risk-management, and vulnerability-remediation processes

• Ansible, Python, Git, REST APIs, or DevOps/SecOps automation in a Mainframe environment

• Integration of IBM Z security with distributed, cloud, IAM, PAM, and security-monitoring platforms

• Mainframe security modernisation, Zero Trust, MFA, passwordless authentication, and automated compliance concepts

Other Requirements

Experience

• Relevant hands-on experience in Mainframe security administration, RACF engineering, IAM, cybersecurity, or IBM Z infrastructure security.

• Experience supporting business-critical enterprise Mainframe environments with strong security and availability requirements.

• Experience administering RACF, ACF2, or Top Secret in enterprise z/OS environments.

• Experience supporting user access management, privileged access, security controls, audit, compliance, and remediation activities.

• Experience working within structured ITIL-based Incident, Problem, Change, and Release Management processes.

• Experience collaborating with cybersecurity, IAM, audit, risk, compliance, Mainframe infrastructure, and application teams.

Desired Profile

• Strong analytical, security, and problem-solving capability.

• Ability to independently investigate and troubleshoot complex Mainframe security and access-control issues.

• Strong understanding of security governance, least privilege, segregation of duties, and access-control principles.

• Good written and verbal communication skills, particularly for technical documentation, audit responses, and stakeholder communication.

• Comfortable working with global delivery, Mainframe infrastructure, cybersecurity, application, IAM, audit, compliance, and vendor teams.

• Strong focus on security, compliance, risk reduction, documentation, automation, and continuous improvement.

• Ability to balance stringent security controls with business availability and operational requirements.