Sr. Application Engineer, Cyber Security

Position Summary:

The Sr. Application Engineer, Cyber Security is responsible for building, managing and supporting information security that underpins all internal and external user technology services, according to security policies and best practices. 

The Sr. Application Engineer, Cyber Security has a strong development experience in numerous programming languages and is the subject matter expert (SME) for concepts behind security controls and how they apply to application development, web presence and API services. This individual is accountable for identifying weaknesses in our security posture within the application or web space while defining methods to achieve security control requirements via automation or highly efficient means that further support timely delivery with minimal overhead. They work across internal and external teams of infrastructure specialists and software engineers making sure services are delivered and used securely as required, offering advice and guidance on security decisions and ensuring the effective use of common tools and patterns.  

The incumbent must have a service-oriented mentality, a high sense of ownership of the problems and requests assigned, a focus on managing and resolving issues in alignment with the SLAs, establishing and maintaining communication with technology customers to keep them updated with status of their requests, initiating and performing changes on production systems and proactively escalating any issues that cannot be resolved within the established timeframes.

Additional insights, experience or background in any of the following are also of great value: NIST, ISO27001, Data Protection, Java Development, Static Code Analysis, Dynamic Code Analysis, Penetration Testing, Containers, MicroServices, CI/CD Pipeline, Agile, Git, Jira, Docker, Kubernetes, cloud security (AWS, Azure, GCP) and design, process maturity, and other related focuses

Primary Accountabilities

Technical (80%)

• Be the primary security expert for multiple product lines and act as the point of contact for engineering and security.

• Perform architecture reviews to steer projects in the right direction, participate in security code reviews, and automate penetration testing against products prior to move to production.

• Support engineering with implementing security fixes, ensuring security scanners are utilized correctly, and develop strategies to proactively secure their architecture.

• Review development frameworks for security functionality, consistency, and uplift opportunities.

• Create threat models and leverage them to prioritize time based on risk impact.

• Evaluate client needs, coordinate design for a solution, and clearly communicate the value proposition of complex and highly technical subjects.

• Implement and/or assess existing security controls.

• Translate logical designs into physical designs; produce detailed designs and document all work using required standards, methods and tools, including prototyping tools where appropriate. 

• Designs systems characterized by managed levels of risk, manageable business and technical complexity and meaningful impact; works with well-understood technology and identifies appropriate patterns.

Project Management (20%)

• Work with application development teams to ensure secure software development lifecycle (S-SDLC) implementation and validation.

• Educate and train product teams.

• Evaluate client needs, coordinate design for a solution, and clearly communicate the value proposition of complex and highly technical cyber security subjects.

Required Qualifications: 

• Bachelor of Science Degree in Computer Science, or a Bachelor of Arts Degree in a related technical field,

• 10+ years of related work experience in security engineering

• Or any equivalent combination of experience and training/certification that provides the required knowledge, skills, and abilities needed to complete the major responsibilities/essential functions of the position

• Certifications preferred.  OSCP, CISSP, GCIH, GXPN, GPEN

• Strong experience in web and mobile app