Senior Application Security Engineer, copper co

• Cloud Native: Detailed knowledge of AWS services and their configuration/operation. Practical experience with security or technically focused projects a must
• Secure by Design: In-depth experience working with cloud ‘secure default’ design patterns and their knowledge of their implementation
• Expertise with different threat & vulnerability classes and associated systemic solutions, removing the possibility of vulnerabilities before they can manifest
• Domain Knowledge: Strong understanding of the S-SDLC. Intimate knowledge of security-specific tooling domains (e.g. SCA, SAST, DAST, MAST) and their effective integration within the S-SDLC
• Awareness of microservice architecture and associated common deployment patterns a must
• Security Industry Knowledge: Deep familiarity with security standards & frameworks e.g., OWASP, MITRE Attack etc and their practical application
• Technical Ability: Hands-on experience with scripting elegant, scalable solutions to encountered problems, and prior experience implementing and/or reviewing terraform for infrastructure deployments (e.g., EC2, networking or lambda) a must; implementation and enforcement of standards in code
• Tooling Proficiency: Hands-on experience with security tooling, REST APIs, Docker, Linux, Git and scripting language(s) of choice
• Strategy-Led Thinking: Previous experience owning the implementation of top-level strategy deliverables and developing work-items that adhere to the wider-organisational goals. Prior experience designing and collaborating on team-strategies a plus
• Risk-First Decision Making: Strong analytical thinking with prior experience providing materials and insight on complex security topics to risk-focused committees and stakeholders alike
• Comfortable contextualising information against wider risk-landscape
• Communication: Exceptional ability to articulate security concepts to a diverse audience, including senior stakeholders, both technical and non-technical

Desirable

• The Senior Application Security Engineer is a key role within Copper's Information Security department, focusing on all technical and process aspects of Copper's SDLC
• This role involves triaging vulnerabilities, collaborating with engineering teams and other information security teams to harden systems, deployments, code, and the improvement of processes & implementation within Copper's CI/CD cycle
• Senior Application Security Engineers work closely with all engineering teams and under the guidance of the Head of Application Security to ensure security standards are baked into Copper's processes, providing the necessary guard rails for rapid, but secure development in a rapidly evolving industry
• Ownership of vulnerability process, tracking and remediation efforts within the engineering department
• Champion for secure coding and infrastructure deployment(s) within Copper’s development community, actively promoting "well architected" best practices and security initiatives within Copper
• Provide insight into emerging technologies and relevant domain areas, assessing their impact on Copper’s current security posture. Provide detailed insight into domain specific topics, becoming Copper’s trusted SME on given security (or technical) topics where required
• Own the design and implementation of technical, scalable solutions to address current posture weaknesses, whether team or department based
• Ownership of multiple security tools and associated vendor relationships. Responsible for ensuring effective integration of tooling into Copper’s SDLC and on-going BAU operation is automated and scalable
• Design and implement technical, repeatable, and scalable solutions to address current posture weaknesses across Copper’s estate
• Engage with numerous stakeholders to ensure security posture weaknesses (risks) are effectively understood and plans for their mitigation are in place, fostering close relationships with key engineering teams to facilitate remediation(s)
• Create, improve, and advocate for security controls and policies within the wider business, in-line with industry-defined best practices and ensure these requirements are effectively understood and adhered to