Director, Application Security and Testing CoE

Company

Cox Communications, Inc.

Job Family Group

Information Technology

Job Profile

Director, Cybersecurity

Management Level

Director

Flexible Work Option

Hybrid - Ability to work remotely part of the week

Travel %

No

Work Shift

Day

Compensation

Compensation includes a base salary of $159,400.00 - $265,600.00. The base salary may vary within the anticipated base pay range based on factors such as the ultimate location of the position and the selected candidate’s knowledge, skills, and abilities. Position may be eligible for additional compensation that may include an incentive program.

Job Description

As the Director of Application Security and Testing Center of Excellence, you will be responsible for leading a team of application security engineers in evaluating the secure coding of Cox Communications’ custom and third-party software, executing automated static and dynamic application security testing, and managing and ensuring compliance with web application firewall policies. You will also lead the Testing Center of Excellence, which coordinates and performs manual penetration tests for web applications, mobile applications, and hardware devices.

You will implement and evolve the Application Security strategy based on ever-changing cyber threats. Your organization will use their deep knowledge of secure coding to ensure security controls are applied throughout the software development lifecycle. Operational activities will include managing automated SAST, SCA and DAST testing processes, coordinating manual penetration testing of applications and devices by third-party providers, partnering with development teams to ensure remediation of findings, and managing the responsible disclosure process for the reporting of vulnerabilities.

You will report to the Senior Director of Vulnerability Management, Application Security, and Controls Monitoring at Cox Communications.

PRIMARY RESPONSIBILITIES AND ESSENTIAL FUNCTIONS:

• Lead an application security team that implements and enforces secure coding guidelines, application vulnerability identification, and risk mitigation throughout the software development lifecycle.

• Manage and drive compliance with web application firewall requirements that protect public-facing product and enterprise websites.

• Manage and drive compliance with secure coding requirements.

• Oversee the Testing Center of Excellence, which coordinates and executes manual penetration tests of web applications, mobile applications, and hardware devices in partnership with third-party providers.

• Oversee project delivery including financials, milestones, deliverables, and internal and 3rd party labor.

• Manage the security researcher responsible disclosure process for reporting vulnerabilities in our public-facing websites.

• Ensure the smooth operation of automated testing processes.

• Identify and implement enhancements to existing processes.

• Build positive relationships with development teams and their leaders and support them in remediation of findings.

• Manage and coordinate Cybersecurity engagement, processes and policy implementation across the organization.

• Lead and contribute during security events and incident response as necessary and identify improvements to prevent them from reoccurring.

• Update strategies based on emerging security trends, threats, and technologies, and recommend appropriate solutions and enhancements.

• Collaborate with cybersecurity peers to incorporate vulnerability management, governance, risk and compliance, cyber defense, continuous controls monitoring, and identity governance into cybersecurity standards as a cohesive cybersecurity organization.

QUALIFICATIONS AND EXPERIENCE:

Minimum

• Bachelor’s degree in a related discipline and 10 years’ experience in a related field. The right candidate could also have a different combination, such as a master's degree and 8 years’ experience; a Ph.D. and 5 years’ experience in a related field; or 22 years’ experience in a related field.

• At least 8 years focused on cybersecurity.

• 5+ years in a people leader role directing and reviewing people’s performance.

• Must have practical expertise in some of the following areas: static source code analysis, manual and automated dynamic analysis, secrets management, web application firewall, and API security.

• Must be able to read and understand common coding languages such as Python, C#, Go, PHP, Java, or JavaScript (Node, Vanilla JS, or React).<