Application Security Engineer – AppSec Automation (100% US REMOTE)

Company Description

Experian is the world’s leading global information services company, unlocking the power of data to create more opportunities for consumers, businesses and society. We are thrilled to share that FORTUNE has named Experian one of the 100 Best Companies to work for. In addition, for the last five years we’ve been named in the 100 “World’s Most Innovative Companies” by Forbes Magazine. 

Job Description

Responsible for implementing our strategy for integrating automated security controls into our evolving development life cycle and CI/CD pipelines to shift security “left”, without sacrificing the developer experience. Ensuring that the requirements of security as per the Software Security Policy and Technical Security Baseline are met for new agile deliveries and for Experian’s Legacy estate with flaws and issues managed effectively throughout all stages of an applications life. 

Engage with the Developer Champions community to support forward momentum to ensure that the latest security techniques are utilized to provide vulnerability free applications that can be delivered at speed to our clients.  

Functions 

• Work with the AppSec Manager and peers to deliver strategy for Automation of security controls (SAST, DAST, SCA…) 

• Integrates 3rd party and builds custom solutions into our CI/CD pipelines and development cycles. 

• Define security guardrails through automated tool policies, SLAs, custom rules, and support the developer community 

• Help the enterprise manage vulnerabilities across automated tooling and manual security assessments 

• Work with Champions to build relationships and ensure key activities are supported and deliverables are achieved in a timely manner. 

• Support education and awareness strategy, rollout for Development community. 

• Support the AppSec technical team (incident response, code reviews, risk assessments) and ensure relationships with Business and team maximized and effective. 

Responsibilities/Requirements 

• Support of AppSec Consultant function. (15%) 

• Leads relationship with Development teams to implement security control automation based on SDLC requirements. (60%) 

• Work with vendors to deliver improvements to development processes as part of defined projects / scope of work. (15%) 

• Document Processes and SOPs (10%) 

Qualifications

Formal Education & Certification 

• Four-year college diploma or university degree in computer science or computer engineering, and/or 5 years equivalent work experience in application development. 

• CSSLP Preferred. 

• Certifications in Application Testing Mechanisms preferred. 

Knowledge & Experience 

• 5 years direct experience in enterprise-level applications security. 

• Experience with SAST, Software Composition Analysis (SCA), DAST, IAST, RASP tooling 

• Experience conducting technical security assessments, code audits and architectural design reviews 

• Experience with automation through solutions such as Chef, Puppet, Jenkins, and Ansible 

• Proficiency with major programming languages like Java, .Net, Python, PHP, C++ 

• Experience in AppSec or DevSecOps groups 

• Experience with CI/CD pipelines 

• Experience with cloud-based application architectures 

• Proven experience in overseeing the linking of cross-functional applications between disparate business units and systems. 

• Experience with business and technical requirements analysis, business process modeling/mapping, methodology development, and data mapping. 

• Strong understanding and background in MITRE, OWASP, SafeCode, risk management methodologies as they relate to integration/software testing. 

• Good project management skills and/or substantial exposure to project-based work structures, project lifecycle models, etc. 

• Strong understanding of end-user needs and requirements. 

• Excellent understanding of the organization’s goals and objectives. 

Personal Attributes 

• Excellent oral and interpersonal communication skills. 

• Outstanding writing and documentation skills. 

• Able to communicate ideas in both technical and user-friendly language. 

• Able to conduct research into application issues and products. 

• Highly self-motivated and directed, with keen attention to detail.