Senior Product Security Engineer, Medallia

• 4 years of experience with software security assessments and remediation in Java (or other object-oriented languages)
• Demonstrated experience in at least two of the following areas: architecture review/threat modeling, penetration testing, and static code analysis automation
• Demonstrated experience with tools and technologies used throughout secure SDLC (e.g., Checkmarx, Fortify SCA, Coverity, AppScan Standard/Enterprise, WebInspect, Netsparker, Burp Suite, Nessus, etc.)
• Have set-up or supported bug bounty programs
• Advocated for security within teams by clearly articulating security risks and mitigation strategies, ensuring that security considerations are prioritized in product development and operational processes
• Developed comprehensive security documentation, including threat models, security coding practices. Ensured documentation was clear, accurate, and useful for both technical and non-technical stakeholders

Desirable

• This Product Security role is a key role to maturing our security program within the development lifecycle of our product portfolio and offers tremendous growth opportunities at a security conscious company on a high growth trajectory
• As Medallia becomes a trusted partner to organizations across the globe and spanning several industry verticals, it is more important than ever that we continue to stay a step ahead in securing our applications, services and data
• The Senior Product Security Engineer role will work closely with our global engineering teams and ensure that we build secure and robust software in the world of SecDevOps and Agile
• Perform application security assessments including architecture review, threat modeling, code review and penetration testing, Bug Bounty triaging on both web and mobile (iOS, Android, and React Native) platforms
• Assist and enable engineering teams to adopt secure development practices
• Provide software security advice to cross-functional teams including product, engineering, and services
• Create and refine the Security Champions Program to align with the Medallia’s security goals and objectives
• Extensive development experience to write automation scripts, conduct in-depth code reviews, identify and address security vulnerabilities, and integrate security features into the application lifecycle
• Work closely with engineering and product teams to drive security issues to resolution
• Develop and mature software security guidance including training materials, best practices, secure development standards,etc
• Automate security testing at scale by building and implementing static[SAST], dynamic analysis tools[DAST], SCA, and integrating security into the software development lifecycle using CI/CD process
• Employ knowledge and deep understanding of the threat landscape, SaaS industry, and customer feedback to drive the pipeline of impactful security features