Security Engineer - DevSecOPS

Key Responsibilities include

• Develop and implement security measures for the Linux kernel and secure enclave environments like AWS Nitro or GCP Confidential computing for our MPC Key management node.
• Offer guidance and support in application security and DevSecOPS, aiding our teams in the integration of security practices.
• Collaborate with the Head of IT Security to refine and advance our security protocols.
• Work closely with clients to set up state-of-the-art penetration testing labs and perform detailed assessments on cloud and edge computing platforms.
• Manage and refine security measures using advanced tools and practices.
• Oversee software security architecture and system integrity through regular vulnerability assessments and penetration testing.
• Utilize a suite of security tools including Snyk, SonarCloud, OSV, Checkov, KICKS, Nessus, and OpenVAS to detect and resolve security issues.
• Foster a culture of security awareness and ensure continuous staff training on security best practices.
• Manage relationships with external vendors, ensuring that third-party services and products meet the organization's security standards and compliance requirements
• Keep abreast of the latest security legislation, advisories, alerts, and vulnerabilities, and technologies to maintain organizational agility and preparedness for emerging threats.

Application Security (AppSec)

• Develop and maintain a comprehensive application security strategy, ensuring the security of software and applications throughout their lifecycle.
• Implement tools and practices for secure code development, including static and dynamic code analysis.
• Coordinate with development teams to integrate security into the software development lifecycle (SDLC).

DevSecOPS Responsibilities:

• Lead initiatives to integrate security into DevOps practices (SecDevOps), ensuring seamless security in the development and deployment pipelines.

• Automate security processes and tools within the CI/CD pipeline for efficient and effective security checks.

• Collaborate with IT and development teams to ensure continuous delivery and continuous integration (CI/CD) processes are secure.

• Train and guide development teams in secure coding practices and awareness of emerging security threats.

• Extensive experience in security engineering with a focus on both software and hardware.

• In-depth knowledge of Terraform and Cloud Security including Kubernetes Security / Hardening.

• Proven track record of successful penetration testing and vulnerability management.

• Familiarity with application security and DevSecOPS principles.

• Demonstrable experience in working with clients to establish and maintain security environments.

• Strong communication skills, with the ability to lead and mentor within cross-functional teams.

Requirements

• You take ownership and prioritize well.
• • You excel in partnering with multiple stakeholders to strengthen the connection and legal brand across the business.
• • You perform risk analysis review for all contractual documents and recommend mitigating options
• • You bring empathy and understanding to your conversations with customers, looking for a path forward that balances company risk and customer needs in a respectful and creative way.
• • You enjoy getting deals done.
• • You have experience working across the globe in support of multiple time zones and
• cultures and can navigate a decentralized and complex organization spread across the
• globe.
• • You have an understanding of software technology and cloud services, associated business
• models, and technology industry trends, privacy developments.
• • You enjoy communicating with the business and customers to help them understand and
• develop trust in the company.
• • A dynamic role, addressing the challenges of high-tech security solutions like Hashicorp vault and DuoKey MPC.
• • Leadership in project management, implementing top-tier DevSecOPSI practices.