Staff Information Security Engineer (Cloud and Application Security)

Responsibilities:

• Direct and approve the design of the appsec and cloud infrastructure security program using DevSecOps methodologies 
• Create and implement new security automation tooling within Achiever’s CI/CD pipeline 
• Build security-relevant services, infrastructure, and secure-by-default libraries for self-service consumption by the development and IT operation teams 
• Implement a shift-left strategy to provide early and useful security feedback to our developers and IT operations on their work 
• Participate in incident response and provide support to security detection functions 
• Lead developer and IT operations technical security training program 
• Perform application and infrastructure threat modeling and architecture reviews 
• Coordinate external pen testing program (ensuring environments setup, fixes deployed and tested)  
• Triage security vulnerabilities from internal and external vulnerability scans and pen testing engagements 
• Design and develop incident response automation workflows 
• Develop automation cases for regression, assertion, and negative testing to find security issues at scale 
• Communicate best practices and risks to all parts of the business, outside IT and development 
• Provide training and mentoring to security team members 

Qualifications:

• 5+ years of relevant cyber security experience 
• 2+ years CI/CD pipeline experience 
• 2+ years experience in developing and maintaining automation frameworks and integrating security testing 
• 2+ years experience working with and deploying containers and microservices 
• 2+ yrs experience with incident handling and automation 
• 2+ yrs experience working with AWS, Azure, and/or GCP (GCP especially preferred) 
• 2+ years of experience with Infrastructure as Code tools, such as Terraform 
• 2+ years of experience in one of scripting languages (preferably Python) 
• Strong Unix/Linux experience 
• Strong understanding of security technologies 
• Knowledge and experience with network, host and application security practices 
• Experience in identifying and exploiting vulnerabilities in web applications, cloud environments, host configurations, and networks 
• Knowledge of all bug classes & common vulnerabilities related to web applications and cloud infrastructure (ex. OWASP top 10) 
• Excellent written and verbal communication skills 
• Understanding of IT compliance and frameworks and regulatory standards (ISO 27001, CoBIT, ITIL, SOX, Trust Principles etc.)