Principal Security Engineer, Storio group

• Excellent communication and collaboration skills to effectively work with developers, engineers, and other stakeholders
• Extensive experience in application security, penetration testing and cloud security
• Development background preferred, with proficiency in one or more of the following programming languages and scripting: Python, C#, JavaScript, TypeScript, HCL, Swift, Kotlin, Terraform, Cloudformation, SDKs etc
• Proven ability to identify and remediate security vulnerabilities in web applications and cloud platforms
• Strong understanding of secure coding practices (e.g., OWASP Top 10) and secure development lifecycles (SDLC)
• Experience with penetration testing methodologies (e.g., OWASP Testing Guide) and tools (e.g., Burp Suite, Metasploit) and implementing OWASP ASVS/M-ASVS/MASDG
• Passion for security and a strong desire to build a secure and robust security posture

Desirable

• The Security team at Storio group consists of 3 pillars, Governance Risk & Compliance, Operations and Engineering
• Whilst we are a team and we expect support across all pillars, you will be the technical lead for the Security Engineering pillar
• Utilising agile principles we aim to continuously learn and adapt to the needs of the organisation
• In your role you will be instrumental in safeguarding our organisation's digital assets with the main focus on Application and Platform security, working directly with our Engineering teams
• Lead and define approaches to improve our security culture, technical excellence and defining best practices for robust security within the organisation
• Own the Application and Platform security standards and ensure adherence through a data driven governance model
• Drive the secure SDLC program within engineering departments and align with the compliance standards Application Security: Conducting thorough assessments, implementing robust security measures, and ensuring the continuous enhancement of our application security posture
• Application Code Security: Addressing identified issues collaboratively with developers and continuously improving code security
• Penetration Testing: Regularly identifying vulnerabilities through proactive penetration testing customer facing websites, mobile applications, thick clients and further reducing the risk of security incidents
• Application Architecture Reviews: Conduct comprehensive reviews to identify and rectify potential security gaps
• Cloud Platform Security Remediations: Leading efforts to remediate security issues at the platform level for a robust infrastructure
• Training and Development: Collaborating with development teams to provide training on secure coding practices and fostering a security-aware culture
• In-House Security Solutions: Utilising a development background to contribute to the maintenance and development of in-house security solutions, such as Security Bots and AWS WAF
• You will be instrumental in safeguarding our ecommerce platform and ensuring the protection of our business continuity and customers' data
• As the security engineering pillar you will be the centre of excellence in regards to Application and Platform security
• As a Principal Security engineer you will play a key role in the education of our engineers, influencing our ways of working and increasing the security knowledge