Application Security Engineering Manager, Platform Security - Seattle
Seattle, WA, United States
Applications have closed
Qualtrics
Know what your customers and employees need, when they need it, and deliver it every time with powerful, AI driven Experience Management (XM) software.When you join one of our teams, you’ll be part of a nimble group that’s empowered to set aggressive goals and move fast to achieve them. Strategic risks are encouraged and complex problems are solved together, by passing the mic and iterating until the best solution comes to light. You won’t have to look to find growth opportunities—ready or not, they’ll find you. From retail to government to healthcare, we’re on a mission to bring humanity, connection, and empathy back to business. Join over 6,000 people across the globe who think that’s work worth doing. Application Security Engineering Manager, Platform Security - Seattle Why We Have This Role As Qualtrics continues to expand the Experience Management (XM) SaaS platform, we must ensure that we’re protecting our customers and their data by building and operating secure systems. With over one thousand software & system engineers contributing to Qualtrics XM every day, we have a large attack surface to evaluate and secure. This role is critical to this mission. Qualtrics is seeking an experienced security engineer with a passion for security and demonstrated leadership abilities to manage our Application Security team. The role may also have oversight of other related areas such as infrastructure and cloud security. This is a new role reporting to the head of platform security that includes a mix of people management, hiring, strategy, program operations and hands-on security engineering responsibilities. The Application Security team is responsible for measures to improve and ensure the security of web & mobile applications, code and related components in Qualtrics SaaS products (including those of our acquired companies). The team owns secure development standards and training, security testing tools focused on the application layer (e.g., SAST, DAST, IAST, SCA), threat modeling, penetration testing, red team, bug bounty and vulnerability disclosure programs. Application Security works in collaboration with other teams within the Information Security organization, including infrastructure and cloud security, vulnerability management, network security, security operations and incident response, and security assurance. How You’ll Find Success
- You will define and drive improvements to the product and application security program; hire, mentor, and support a team of skilled security engineers; and work effectively with the Qualtrics engineering organization and fellow security team members to protect our customers and their data by building and operating secure systems.
- Experience with assessing/securing large, complex SaaS applications
- One or more relevant security certifications (CISSP, CISM, CEPT, CMWAPT, CPT, CEH, LPT, GWAPT, GPEN, GXPN, OSCP)
- Two or more years of experience as a people manager
- Use of agile methodologies for project management
- Manual web application penetration testing experience, including the use of professional penetration testing tools (e.g., Burp Suite)
- Strong familiarity with AWS, Docker, Kubernetes, Linux and similar infrastructure & technologies
- Experience securing iOS/Android mobile apps
- Prior full time software development experience is strongly preferred
- Exercise and grow your leadership skills by providing program strategy (e.g., defining what the future of our appsec program should look like), thought leadership (e.g., influencing others across the organization to adopt new solutions which solve security problems at scale), project & program leadership (e.g., getting critical initiatives to completion), people leadership (e.g., mentoring team members to help them also grow and take on new responsibilities)
- Continuous learning - you will have the opportunity to learn about the variety of modern technologies and frameworks being utilized or added to the Qualtrics application ecosystem so that you can ensure we are successfully applying securing them.
- Develop and execute the product & application security architecture and program strategy; align and communicate roadmaps with stakeholders
- Support and manage a team of security engineers through regular 1-on-1 sessions and team meetings, coaching, workload management and performance reviews
- Review source code & software/system designs, and consult with engineers across the organization to identify and/or avoid security issues through alignment with security standards and best practices
- Leverage your accumulated subject matter expertise of Qualtrics applications, systems and code to propose and drive architectural improvements which address classes of security flaws in the platform
- Document and improve secure development lifecycle processes, standards and guidelines
- Deliver training and provide mentoring to software engineers on security topics
- Facilitate threat modeling exercises to ensure optimized security design decisions are being made
- Document remediation recommendations and collaborate with engineers to ensure vulnerability findings are successfully and efficiently addressed
- Oversee bug bounty and vulnerability disclosure programs, including the triage and validation of reported findings
- Oversee internal purple and red team exercises to proactively evaluate Qualtrics environments for security flaws
- Direct the selection, design, development, implementation and management of automated security testing tools; maintain relationships with product vendors and manage contract lifecycles
- Bachelor’s degree in Computer Science or a related field
- Over 10 years of relevant work experience
- Experience as a senior/staff/lead security engineer in product or application security
- Experience leading security projects and initiatives that require collaboration with teams across an organization
- Sound understanding of application security vulnerabilities (e.g., OWASP Top 10), defense techniques and security best practices, including language-specific security practices and present-day threats
- Experience with modern application development languages and frameworks (e.g., Node.js, Java, Golang, Python, React, Angular)
- We work with a wide array of modern technologies and need to scale our solutions to tens of thousands of end points, over a thousand engineers, and worldwide data centers and cloud environments
- We emphasize establishing a career development plan and will help you to find meaningful work assignments, learning opportunities and mentorships which will aid your growth and development
- We work closely with our peer platform security teams and enjoy coming together in person and remotely to build relationships and have fun
- Qualtrics pays 100% of the healthcare benefit premiums for employees and their dependents.
- Catered lunches, free snacks and drinks
- Full time employees receive an annual experience bonus after their first year of employment. Qualtrics Experience Bonus is a program designed to provide experiences to our employees they might not otherwise have.
- We spend 10% of our time on individual engineering growth activities every quarter
- Quarterly book budget to continue learning and quarterly fitness budget
For full-time positions, this pay range is for base per year; however, base pay offered may vary depending on location, job-related knowledge, education, skills, and experience. For part-time or intern positions, this pay range is for base pay per hour. A sign-on bonus and restricted stock units may be included in an employment offer, in addition to a range of medical, financial, and other benefits, based on eligibility criteria.
Washington State Pay Transparency Range$166,000—$302,500 USDTags: Agile Android Application security AWS Burp Suite CEH CISM CISSP Cloud Computer Science DAST Docker Golang GPEN GWAPT GXPN IAST Incident response iOS Java Kubernetes Linux Network security Node.js OSCP OWASP Pentesting Polygraph Python Red team SaaS SAST Strategy Vulnerabilities Vulnerability management
Perks/benefits: Career development Flex vacation Medical leave Salary bonus Signing bonus Startup environment Team events Transparency
More jobs like this
Explore more InfoSec / Cybersecurity career opportunities
Find even more open roles in Ethical Hacking, Pen Testing, Security Engineering, Threat Research, Vulnerability Management, Cryptography, Digital Forensics and Cyber Security in general - ordered by popularity of job title or skills, toolset and products used - below.
- Open Information Security Specialist jobs
- Open Senior Cyber Security Engineer jobs
- Open Ethical hacker / Pentester H/F jobs
- Open Information Systems Security Officer (ISSO) jobs
- Open Principal Security Engineer jobs
- Open Product Security Engineer jobs
- Open Cyber Security Architect jobs
- Open Manager Pentest H/F jobs
- Open Staff Security Engineer jobs
- Open Cyber Security Specialist jobs
- Open Senior Information Security Analyst jobs
- Open Cybersecurity Analyst jobs
- Open Chief Information Security Officer jobs
- Open Consultant infrastructure sécurité H/F jobs
- Open IT Security Analyst jobs
- Open Cybersecurity Consultant jobs
- Open Consultant SOC / CERT H/F jobs
- Open Senior Information Security Engineer jobs
- Open Security Specialist jobs
- Open Senior Penetration Tester jobs
- Open Senior Security Architect jobs
- Open Cybersecurity Specialist jobs
- Open Security Researcher jobs
- Open IT Security Engineer jobs
- Open Security Operations Analyst jobs
- Open CISM-related jobs
- Open Windows-related jobs
- Open Network security-related jobs
- Open ISO 27001-related jobs
- Open Pentesting-related jobs
- Open Application security-related jobs
- Open Agile-related jobs
- Open GCP-related jobs
- Open Vulnerability management-related jobs
- Open SaaS-related jobs
- Open CISA-related jobs
- Open Analytics-related jobs
- Open IAM-related jobs
- Open Threat intelligence-related jobs
- Open APIs-related jobs
- Open Java-related jobs
- Open Security assessment-related jobs
- Open Malware-related jobs
- Open DevOps-related jobs
- Open IDS-related jobs
- Open Security Clearance-related jobs
- Open Forensics-related jobs
- Open EDR-related jobs
- Open CEH-related jobs
- Open Kubernetes-related jobs