jobscapital

<div><strong>About the Job</strong></div><div>Featured</div><div>We are looking for a technical subject matter expert who can show developers how they can secure their traditional cloud and cloud native applications. This person will design, define, and implement security requirements, controls, and processes to properly secure our cloud-based applications. This person will be responsible for and driving the “SEC” in our DevSecOps process and evangelizing it’s benefits and outcomes.</div><div><strong>Core Responsibilities</strong></div><ul><li>&nbsp;Work independently and collaboratively with various teams.</li><li>&nbsp;Implement, onboard, and enforce Application Security tools (SAST, SCA, IaC, DAST and IAST), including cloud-based CI/CD Pipelines.</li><li>&nbsp;Coordinate software security initiatives with various teams.</li><li>&nbsp;Manual and tool-based vulnerability management of priority issues.</li><li>&nbsp;Perform threat modeling and technical design reviews of sensitive features, highlight risk, and help developers improve the overall security of our products.</li><li>&nbsp;Define, develop and automate the deployment or our Azure security tools and services.</li><li>&nbsp;Partner with application teams to implement application security standards, patterns and guidelines.</li><li>&nbsp;Assist in developing Source Code Review and application security checklists.</li><li>&nbsp;Advise developers on how to implement security into DevSecOps CI/CD pipelines</li><li>&nbsp;Partner with Infrastructure teams to implement technical security standards, patterns, and guidelines for server and serverless based platforms.</li><li>&nbsp;Educate developers in application security best practices and least privilege principles.</li></ul><div><strong>Required Skills</strong></div><ul><li>&nbsp;Must have expert Knowledge of Azure security services (Azure Security Center / Azure Sentinel)</li><li>&nbsp;Mid-level knowledge of tools such as Terraform, Kubernetes, Jenkins, Azure DevOps</li><li>&nbsp;Current experience in security testing, assessment, and methodologies (including browser-based, API, CI/CD pipeline, and Mobile)</li><li>&nbsp;Strong working knowledge of at least two programming or scripting languages, preferably Java. Having C++, C#, or Python, and mastery of object-oriented design and programming helpful.</li><li>&nbsp;Current experience in threat modeling, and technical design reviews.</li><li>&nbsp;Current experience using in at least 1 AppSec (SAST, DAST, IAST) tool sets.</li><li>&nbsp;Strong scripting skills in at least one language, preferably Python.</li><li>&nbsp;Strong Knowledge of CI/CD processes</li><li>&nbsp;Familiarity with manual and automated vulnerability management and resolution across multiple teams.</li><li>&nbsp;Familiarity with securing cloud-based resources, including containers, Apps services v3, and other PaaS services in Azure.</li><li>&nbsp;Knowledge of configuration and information management analysis, such ask XML, JSON, etc..</li><li>&nbsp;Strong understanding of security principles, policies, and industry best practices.</li><li>&nbsp;Familiarity of various compliance frameworks (HIPAA, PCI DSS, NIST, etc.).</li><li>&nbsp;Familiarity with Open Web Application Security Project (OWASP), Software Assurance Maturity Model (SAMM), Application Security Verification Standard (ASVS), National Institute of Standards and Technology (NIST) Special Publications.</li></ul><div><strong>Qualifications</strong></div><ul><li>&nbsp;Bachelor's Degree or 7 years developer experience with 3 years of application security or equivalent required</li><li>&nbsp;Minimum of 5 years in Software Development</li><li>&nbsp;Minimum of 3 years' experience supporting security in CI/CD pipelines</li></ul><div><br></div>