MQ Security Specialist

MQ Security Specialist

About the Role

L1: We are seeking an MQ Security Specialist to lead security integration for IBM MQ for z/OS during the ACF2 to RACF migration. This role will ensure MQ queue manager, queue, channel, listener, CHINIT, command, process, namelist, service ID, certificate, TLS, and secure messaging controls are converted, validated, and operationalized without disrupting critical business messaging flows.

Key Skills and Expertise

L2: Key skills include IBM MQ for z/OS, ACF2 MQ rules, RACF MQ classes, queue manager security, queue authorities, channel security, CHINIT, listeners, MQ command and object security, certificate and TLS controls, keyrings, started tasks, service IDs, application and batch integrations, MQ logs, SMF, channel messages, message flow validation, and regression testing.

Key Responsibilities

·        Own MQ security conversion design from ACF2 rules to RACF profiles, groups, permits, and MQ class-specific controls.

·        Define RACF controls for MQ queue managers, queues, channels, processes, namelists, listeners, CHINIT, commands, and administration functions.

·        Validate MQ started task IDs, queue manager IDs, CHINIT IDs, service IDs, application IDs, surrogate access, and batch integration authorities.

·        Coordinate digital certificate, keyring, TLS, channel security, and secure messaging access with the infrastructure and RACF engineering leads.

·        Review MQ object authorities, channel configuration, listener setup, CHINIT controls, and connection flows for migration impact.

·        Lead MQ regression testing, connectivity testing, message flow validation, channel authorization testing, and negative authorization testing.

·        Troubleshoot MQ authorization failures using RACF messages, MQ logs, SMF records, channel messages, and application diagnostics.

·        Coordinate application owner sign-off for MQ workloads in each migration wave.

·        Produce MQ security evidence and BAU support procedures for post-migration operations.

Experience and Qualifications

·        12+ years of IBM MQ for z/OS, messaging services, or mainframe middleware security experience.

·        Strong knowledge of IBM MQ for z/OS security in RACF or ACF2 environments.

·        Experience supporting critical production messaging workloads in regulated environments.

·        Experience with TLS, digital certificates, service IDs, MQ regression testing, and production cutover support.

 Technical Skills - Must Have: MQ Security Specialist

Domain

Required knowledge

MQ security

Queue managers, queues, channels, CHINIT, listeners, MQ command and object security

RACF integration

MQ RACF classes, profiles, permits, logging, generic naming, queue manager and CHINIT access

Certificates/TLS

DIGTCERT, keyrings, TLS, channel security, secure messaging connectivity

Testing

Message flow validation, channel authorization testing, negative testing, cutover checks

Operations

MQ logs, SMF, channel messages, incident triage, application sign-off

Technical Skills - Preferred 

Domain 

Preferred knowledge 

Tooling 

CICS Explorer, CPSM, MQ Explorer, zSecure

Automation 

CICS/MQ deployment automation, Ansible for Z, certificate lifecycle automation 

Certifications 

IBM CICS, IBM MQ, z/OS security, or equivalent