Senior Test Penetration Engineer, Guidewire
Back-end software for P&C insurance
Job no longer available
Back-end software for P&C insurance
1001+ employees
Job no longer available
1001+ employees
Company mission
To constantly improve, so insurance companies can successfully respond to customer needs in a world where technology and risk are changing dramatically.
Role
Who you are
- Bachelor's/master’s in computer science or equivalent
- Industry related certifications are preferred (E.g. CSSLP, CISSP, GIAC, OSCP, etc.)
- Minimum 7-10 years of relevant Application Security Experience
- At least 2-5 years of experience with Penetration testing
- Solid understanding of OWASP Top 10, common classes of product security vulnerabilities and attack/defense methodologies
- Strong written and verbal communications skills
- Proven ability to build relationships and influence individuals at all levels, as well as external security researchers, vendors and service providers
- Experience with various application security tools - Static code analysis, dynamic code analysis, vulnerability scanning, pen testing
- AWS/Cloud Experience a strong plus
- Bug bounty program participation a plus
- Knowledge of the security research community is a strong plus
- Scripting skills (i.e. Python/Perl/Ruby, shell scripting) or development experience (Java/C++/Python) is a significant plus!
What the job involves
- Come and join our Guidewire PSIRT (Product Security Incident Response Team) and be a part of a high-powered and high-performing team that regularly works across the entire organization, with everyone from product teams to executives
- Urgent escalations from enterprise customers, investigating reported vulnerabilities, performing root cause analysis and working with security researchers
- Guidewire product vulnerability management process for all Guidewire applications
- Coordination of customer/external product security incidents and reported security issues affecting various Guidewire products and applications
- Working cross-functionally with all business units, sustaining engineers, product security team members, customer support, legal and external security researchers to ensure timely resolution of security incidents and events
- Development, maintenance and continuous improvement of the product security incident monitoring, detection and response tools and process, including all required supporting materials
- Pen testing Guidewire applications to ensure timely discovery of the vulnerabilities
- Security Review and Code Review of Guidewire applications
- Ensure proper execution of PSIRT Process - triage security related issues (external / internal), verify those on different versions, products
- Perform root cause analysis to ensure validity of reported issues
- Triage code defect based issues, quantitatively evaluate risk and provide guidance to engineering teams regarding the impact of security issues using industry standard metrics such as CVSS
- Work closely with project management, product management, engineering and sustaining teams to drive issues to closure
- Cultivate strong working relationships with external researchers, reporting organizations and customers to ensure effective collaboration. Work with customer facing and internal teams to continually improve processes used to identify and fix product security issues
- Enhance existing product security incident response program
- Coordinate with internal product development teams in accomplishing regular security reviews and penetration testing assessments
- Execute the penetration tests internally to identify critical vulnerabilities
- Perform security-focused code reviews
- Support the preparation of security releases
- Develop security tooling and automation
- Assist teams in reproducing, triaging, and addressing application security vulnerabilities
- Validate findings from security scanning tools and ideate data-driven enhancement strategies for dynamic (DAST), static (SAST), open-source application security testing (SCA) and container security scanning including troubleshooting, and continuous process improvement
Our take
Insurance is an age-old industry rooted in ancient technology. Despite the substantial power and revenue of these companies, their backend systems have become outdated, leading to rising relative costs. The challenge of modernizing such entrenched systems has been a significant hurdle for many insurers.
Guidewire is at the forefront of transforming Property and Casualty insurance by offering cutting-edge software solutions delivered via the cloud. The company is dedicated to evolving its offerings through close collaboration with its extensive customer base. This intimate engagement helps Guideire refine and enhance its cloud solutions to better meet the needs of it sclients.
Despite its successes in facilitating the cloud transition, the future may see the emergence of insurance providers built on entirely different infrastructures. Guidewire's ability to adapt and leverage its expertise and adapt will be crucial for maintaining its role as a leading technology provider.
Steph
Company Specialist at Welcome to the Jungle
Insights
2% employee growth in 12 months
Company
Funding (2 rounds)
Mar 2008
$0.8m
SERIES C
Sep 2007
$24m
SERIES C
Total funding: $24.8m
Company HQ
South San Mateo, San Mateo, CA
Leadership
Mike Rosenbaum
(CEO, not founder)Prior to Guidewire, they led Product Management and Go-To-Market Strategy for core CRM products at Salesforce and served in the US Navy as a Submarine Officer.
Salary benchmarks
We don't have enough data yet to provide salary benchmarks for this role.
Submit your salary to help other candidates with crowdsourced salary estimates.
Share this job