Senior Product Security Engineer, Splunk

• 8+ years of experience in a security engineer capacity with a Bachelor's degree in computer science, or equivalent degree
• Must have experience with threat modeling or security assessments, product security concepts, and security architecture code reviews
• In depth knowledge on the best remediation techniques for different application vulnerabilities and the ability to explain them to product teams
• Ability to provide pragmatic security advice for web applications, mobile applications, hybrid Cloud software
• In-depth knowledge of common security threats, such as attack-techniques, evasive techniques, and preventative & defensive methods
• Understanding of security features in Container and Container Orchestration technologies (Docker, Kubernetes, etc)
• Deep knowledge of cloud operational models and secure SaaS architecture in a world of containerized microservices
• Deep understanding of browser security and JavaScript frameworks
• Understanding of web technologies: React+Redux, GraphQL, Web-Sockets, etc
• Familiarity of compliance requirements for certifications like PCI DSS, SOC2, HIPAA, FedRAMP
• Experience addressing systemic security issues through root cause analysis, building security solutions, and project leadership
• US Citizen required

Desirable

• As a product security engineer you will lead security and vulnerability assessments in collaboration with the product team to assure the secure release of Splunk products
• This role will report to the Senior Manager, of Product Security
• Perform threat modeling and act as a point of contact for the product team to discover insecure design patterns and threats in Splunk’s product, performing security design reviews of distributed systems, APIs, and hybrid Cloud solutions
• Driving vulnerability assessments for engineering teams and help remediate security concerns and active incidents, and proactively gives strategy recommendations
• Support the development teams through providing security consultation services and becoming an expert for your assigned products
• Develops and owns high complexity security automation tools, and CICD integration, familiar with revision control systems (git, etc), merge request and deployment of artifact/libraries
• Comfortably leads security design discussions, threat assessments, proposes and discusses solutions to security tools, CICD pipeline changes and pen testing that are directly related to their area of focus