Principal Application Security Engineer, Blackbird AI

• Bachelor’s or Master’s degree in Computer Science, Information Security, or a related field
• Minimum of 10 years of experience in application security engineering
• Proven experience in achieving security certifications such as SOC2, FEDRAMP, GDPR etc
• Deep understanding of AWS services and security best practices
• Strong knowledge of security principles, practices, and technologies related to AWS and Kubernetes
• In-depth understanding of web, API, and microservices security
• Expertise in cloud infrastructure security, especially AWS services like IAM, EC2, S3, and Lambda
• Solid grasp of common security vulnerabilities and mitigation techniques, especially in containerized environments (Docker, Kubernetes)
• Familiarity with DevSecOps practices and CI/CD pipelines
• Hands-on experience with security tools such as static/dynamic analysis tools (SAST/DAST), vulnerability scanners, and penetration testing frameworks
• Proficient in security assessment tools and methodologies
• Strong knowledge of compliance frameworks and standards (e.g., SOC 2, ISO 27001)
• Experience with penetration testing tools and techniques
• Familiarity with programming languages such as Python, Go, or Java

Desirable

• We are seeking a highly skilled Principal Application Security Engineer to join our team
• Reporting directly to the CISO, you will play a critical role in securing our applications and infrastructure hosted on AWS and Kubernetes
• Your expertise will be instrumental in helping us achieve key security certifications such as SOC 2, overseeing penetration testing, and implementing best practices to enhance our security posture
• Security Strategy and Leadership
• Develop and implement a comprehensive application security strategy aligned with company objectives
• Lead initiatives to achieve security certifications, including SOC 2, FEDRAMP, GDPR compliance
• Collaborate with cross-functional teams to integrate security best practices into all stages of the Software Development Lifecycle (SDLC)
• Application and Infrastructure Security
• Assess and enhance the security of applications hosted in AWS and Kubernetes environments
• Conduct regular security assessments, code reviews, and vulnerability scans
• Implement security controls and policies to protect against threats and vulnerabilities
• Compliance and Certification
• Prepare and lead efforts to achieve SOC 2 certification and maintain compliance
• Coordinate with external auditors and ensure all security documentation is up-to-date
• Monitor and enforce compliance with industry standards and regulations
• Penetration Testing and Risk Assessment
• Plan and oversee regular penetration testing activities
• Analyze test results and work with development teams to remediate identified vulnerabilities
• Continuously monitor for emerging threats and adjust security strategies accordingly
• Education and Mentorship
• Provide training and mentorship to engineering teams on secure coding practices
• Promote a culture of security awareness throughout the company