Senior Engineer - Product Security - REQ001704_13-3175

at The College Board in Springfield, Illinois, United States

Job Description

• Partner Program - Partnership Development (50%)
  • Act as a liaison between Product Security teams (both in IT and outside of IT) and the Information Security Office via regular engagements with assigned Partner teams. Embed into planning and grooming sessions.
  • Develop deep understanding of our Security Policies and Audit requirements in order to support assigned Partner teams, GRC Exceptions and Audit efforts (PCI, SOC2, ISO27001, GDPR, State Contract requirements)
  • Create Threat Models and Risk Registers for your assigned products and communicate application risks and vulnerabilities to technical stakeholders.
  • Lead application vulnerability reviews and remediation efforts. Develop deep skill sets in understanding, managing and determining exploitability of vulnerabilities to properly determine risk and priority.
  • Work to gain a deep understanding of your assigned products' architectures, Supply Chain (Vendors, Partners, Third Party) Development Practices, CI/CD, GRC Exceptions, Release cadence in order to understand and support mitigation of security risks.
  • Lead efforts to mentor developers through discussions, presentations, or hands on training sessions to demonstrate best practices in developing secure code and securing application infrastructure.
  • Ensure all assigned products and applications adhere to the Product Security Framework requirements and work to remediate any gaps.
• Elevate Product Security 25%
  • Drive and lead efforts to promote, grow and enhance the Product Security Partners program to develop Security Champions and enable dev teams to shift left.
  • Lead development of innovative guidance and training sessions to grow Product Team's Secure Development LifeCycle skills and awareness and cultivate a culture of Product Security
  • Coach product teams and junior team members on performing secure reviews of application architectures and document and advertise new security patterns as needed.
  • Partner with junior team members and foster their ability to develop threat models and risk assessments to identify application security weaknesses or lack of maturity in development processes and provide coaching on remediation strategies.
  • Innovate, stay atop current activities in the industry to support continuous improvement of our Partner Program.
• Operations 25%
  • Drive implementing and operationalizing security tooling and common integrated development environments (AWS).
  • Drive development of key metrics and KPI's to measure Product Security impact and report on assigned partner teams security posture and maturity of practices.
  • Participate in planning and grooming as part of agile ceremonies and manage assigned Epics.
  • Provide hands on expertise with CI/CD and build pipelines to further enhance quality and security gates; lead integration of automated solutions to increase security in CI/CD.
  • Work with broader ISO team on incident response and operational/strategic initiatives.
  • Lead evaluation and improvement of new and existing security standards, tools, and solutions with a focus on automation and securing build pipelines for a shift left approach.

• 5-8 years of progressively responsible, directly related, hands on experience in application security or devsecops

• Strong hands on knowledge of Secure Development practices, Secure Development LifeCycle, DevSecOps, Pen Testing and Threat Modeling

• Solid experience with securing AWS Services, AWS Secure Architectures, Application Security and Cloud Applications, including Software Supply Chain and micro service architecture
• Must have a thorough understanding of web protocols TCP/IP, UDP, HTTP, HTTPS, SSL, TLS, DNS, etc.

• Hands on experience of reproducing and remediating common application vulnerabilities (OWASP/SANS) such as cross-site scripting (XSS), session hijacking, SQL injection, CSRF (Cross-Site Request Forgery), OWASP Top 10, and other attack vectors.

• Solid hands on experience with CI/CD, Nodejs, React, Restful Api's and common development frameworks (Angular, Bootstrap, Node, Struts, Spring, ASP.NET MVC, etc.)

• Experience with key Development tools/systems (Artifact Management, Version Control, Work Tracking, Secrets Management, NPM, Build and Deployment Tools, etc.)
• Experience with RESTful web services and API's
• Ability to travel when required.
• You are authorized to work in the US

• Application review will begin immediately and will continue until the position is filled
• While the hiring process may vary, it generally includes: resume and application submission, recruiter phone screen, hiring manager interview, performance exercise such as live coding, a panel interview, a conversation with leadership and reference checks

• A comprehensive package designed to support the well-being of employees and their families and promote education. Our robust benefits package includes health, dental, and vision insurance, generous paid time off, paid parental leave, fertility benefits, pet insurance, tuition assistance, retirement benefits, and more
• Recognition of exceptional performance through annual bonuses, salary growth over time through market increases, and opportunities for merit raises and promotions based on increased scope of responsibility
• A job that matters, a team that cares, and a place to learn, innovate and thrive