Senior Application Security Engineer, Thinkific

• Has 2+ years experience as an Application Security Engineer and 5+ years experience in a security engineering position
• Possesses strong experience securing infrastructure in Amazon Web Services (IAM, VPC, Route 53, ELB, EC2, Lambda, RDS, Redshift, Elasticache, S3, Cloudtrail, GuardDuty, Kubernetes, etc.) via automation (Terraform, Ansible, Lambda, etc.), or direct equivalent services in other Platform as a service (PaaS) providers
• Has strong experience securing web applications (OWASP) and administering linux-based systems
• Demonstrates experience writing security-focused tests in languages such as CodeQL and writing and maintaining policy-as-code practices
• Holds firm knowledge of threat modeling and risk assessment techniques within the shared responsibility model
• Displays an understanding of implementing security monitoring, logging, and alerting and a working knowledge of containerized environments (i.e. Kubernetes)
• Has exceptional written and verbal communication
• Has the ability to work remotely and manage their own time in a distributed team
• Demonstrates experience securing REST and GraphQL APIs and programming in Ruby, Golang, or Javascript
• Loves to learn and grow. They’ve found (and keep looking for) ways to level up their skills in this field, whether that’s through formal education, gaining professional experience, or maybe even building their own business

Desirable

• Reporting to the Director, Information Security, you will leverage your experience within the security space to work closely among Security, Product, and Engineering teams to assess and remediate risk, as well as design and support new security-related processes within our Software development lifecycle (SDLC)
• Collaborate closely with development teams, conduct code reviews and provide guidance to integrate robust security measures into application code
• Lead the development of threat models for our applications, identifying potential vulnerabilities and guiding mitigation strategies
• Implement secure coding practices within the SDLC and work on continuous improvement based on feedback
• Stay up-to-date with the latest cybersecurity threats and actively apply best practices to protect our applications
• Conduct and oversee penetration testing activities to proactively identify and address security weaknesses in our applications
• Play a key role in the creation and enforcement of internal security policies that prioritize the security of application code
• Contribute to compliance efforts by assisting in reporting, dashboarding, and participating in audits with a specific focus on application security objectives
• Serve as the primary point of contact for security incidents related to application vulnerabilities and respond swiftly to remediate issues