Application Security Engineer

We are UMG, the Universal Music Group. We are the world’s leading music company. In everything we do, we are committed to artistry, innovation and entrepreneurship. We own and operate a broad array of businesses engaged in recorded music, music publishing, merchandising, and audiovisual content in more than 60 countries. We identify and develop recording artists and songwriters, and we produce, distribute and promote the most critically acclaimed and commercially successful music to delight and entertain fans around the world.
 

How you’ll LEAD:

Our team is looking for a Application Security Engineer with extensive product security experience and deep expertise in web security, applied cryptography, software security vulnerabilities, knowledge of IAM solutions including federation as well as superb knowledge of software security standards/best practices to join our team.

We take security very seriously, and protecting our customers is our highest priority. If you are a self-starter who is passionate about security and is excited to work in a highly collaborative environment alongside a diverse team of experts every day, this position is for you.

You will be the technical subject matter expert for multiple areas of application and product security. You will be responsible for performing design reviews, technical security assessments, and code reviews to highlight risk and help engineering teams improve the overall security of our products. You will be a security leader within the company, gaining a solid understanding of our products and systems, and ensuring that security is built in. This position requires both deep and broad technical knowledge across a range of disciplines, and the ability to work hands-on across a wide variety of software designs and technology stacks.

In addition to having strong technical skills, you must be comfortable in effectively communicating with business end users, technical IT teams, business partners, network providers, and business process outsourced vendors, all while being sensitive to a wide diversity of cultural and technical backgrounds in a global business environment.

How you’ll CREATE:

• Perform design reviews and technical security assessments to highlight risk and help engineering teams improve the overall security of our products.
• Design and implement security best practices and standards across varied engineering teams and environments.
• Implement and conduct code reviews with a combination of static testing, manual reviews, and dynamic analysis / pen-testing.
• Conduct threat modelling, identify & drive risk decisions, and influence technical designs and architectures.
• Engage with developers to provide remediation support.
• Perform security reviews of new services and features.
• Build tools to simplify and automate Vulnerability Management processes
• Providing engineering designs to mitigate security vulnerabilities in new software solutions.
• Design and implement tooling and automation for application security (e.g. SAST/DAST in CI/CD).
• Performing regular security testing as well as code reviews for improving the software security.
• Maintaining technical documentation related to software security.
• Ensuring software security at all levels of the architecture.
• Staying updated with latest tools and advanced industry practices for software security.
• Advocate for security culture and educate colleagues across all parts of UMG.

Bring your VIBE:

Essential:

• Technical and foundational knowledge of software engineering, computer systems, security engineering, authentication, and/or applied cryptography.
• Excellent knowledge of all web technologies, especially web services, web applications, Service Oriented Architectures, and network/web protocols
• Sound knowledge of all procedures, standards, and regulations for authorization and authentication, applied cryptography, and security vulnerabilities.
• Strong experience in web security and federation protocols (SSL/TLS, REST, OAuth, SAML, LDAP-S, SAML, WS-Federation, SCIM, OAuth, and OIDC, XSS, etc.)
• Experience working with AWS or other cloud environments (development/architecture)
• Experience with cloud and web application security standards (OWASP ASVS, SANS 25, etc.)
• Understanding beyond the OWASP Top 10 by explaining the level of risk to the business.
• 3+ years of experience in software development in one or more of the following programming languages, .NET, Python, Java, JavaScript (Node/React), and/or Go
• Comfortable with tools like Snyk.io, BluBracket, NoName Api security, Burp Suite, OWASP ZAP, CheckM