Secure Product Developer

The Application Security Engineer will be responsible for developing secure products by providing best-in-class application security services to the product development organization. This role is responsible for proactively working with our product team to build secure software, validating code-level compliance with security standards, assessing applications and services for weaknesses, and working with our development teams to correct security defects.

This includes:

• Providing application/product security guidance to globally distributed product development organization.
  
• Advising and educating development teams with respect to application security best practices, security automation within the SDLC, and the proper use of application security products and services.
  
• Performing application security assessments of internally developed products and systems, covering architecture, design, and implementation.
  
• Building threat models for and performing architectural risk assessments of internally developed products and systems.
  
• Performing automated and manual security code reviews.
  
• Building and maintaining positive and productive working relationships with product development teams and individuals.
  
• Providing assistance in response to product security incidents where application/product security expertise is required.
  
• Participating in blameless postmortems and retrospectives in effort to improve security of products/systems.
  
• Developing security assessment scripts and frameworks.
  
• Developing applications and/or scripts as needed to support product security tooling, automation, or other day-to-day work.
  
• Continuously learning and keeping abreast of the latest technical developments in the application/product security and cloud security spaces.
  
• Researching into and presenting on relevant security technology, practices, and threats.
  
• Working closely with a small team of application security and penetration testing staff, in conjunction with product development, to ensure company products and services withstand foreseen and reasonable attacks.
  

To be successful in this role, you will need the following skills and qualifications:

• A Bachelor's Degree in Computer Science, Software Engineering, Computer Engineering, Electrical Engineering, Electronics Engineering, or related field.
  
• 4+ years of experience as a software engineer/developer in a product development organization with a focus on application security, specifically reviewing code, identifying security defects, and working with developers to make the appropriate corrections.
  
• 2+ years of hands-on experience in application security, reviewing, assessing, and providing guidance to product development teams.
  
• Knowledge of application security vulnerabilities and best practices including OWASP & SANS identified common security coding flaws, a general understanding of threat modeling, and automated & manual static security code analysis.
  
• Experience with application security scanning tools including SAST, SCA, and DAST; Familiarity with GitHub Advanced Security is a plus.
  
• Demonstrable knowledge of coding in two or more of the following: C#, Java, JavaScript, Python, or SQL.
  
• Knowledge of authentication & authorization techniques, public cloud security, and cryptography.
  
• Strong analytical and problem-solving skills.
  
• Excellent communication (oral, written, presentation) skills.
  
• Penetration testing experience is desirable.
  
• GWEB highly desirable; GWAPT, GXPN, OSCP, OSCE, OSWE, OSEE certifications also desirable.
  

We offer a competitive salary and benefits package, as well as opportunities for professional growth and development.

This role is a full-time position, and the ideal candidate will have a mid-senior level of experience.