Senior Application Security Engineer, Huntress

• Demonstrable experience leading application security design and architecture reviews with a key focus on Ruby on Rails
• Extensive experience working with developers and driving application security standards
• Expertise owning software vulnerability management from triage, assessment, and analysis to remediation through collaboration with internal development teams
• Experience securing CI/CD pipelines by enabling strong security controls through the implementation of off-the-shelf and custom-built tooling
• Experience deploying, tuning, and automating common security testing tools within SAST, DAST, SCA, and IaC functional areas
• Expertise in threat modeling frameworks and processes
• Familiarity with IaaS/PaaS cloud infrastructure, infrastructure as code, and software-oriented architecture

Desirable

• The Huntress Information Technology and Security team has the unique honor of securing the infrastructure that enables us to confidently protect over 4 million (and rapidly growing) of our partners’ endpoints
• As our application security engineer, you will be responsible for implementing a robust application security program across internal development teams
• You will mentor and guide teams to think about application security earlier in the development process and ensure that vulnerabilities are remediated before and after they make it into production
• Design, evaluate, and implement software security standards
• Build tools, processes, and solutions that drive continuous improvement in the Huntress security platform
• Influence and guide teams on secure-by-design principles by actively participating in architectural and design discussions to identify and mitigate security risks early in the development lifecycle
• Act as a security subject matter expert, providing a final set of eyes on high-risk pull requests (PRs)
• Lead and conduct secure development training for engineering teams, educating them on common vulnerabilities, bugs, and best practices to proactively embed security throughout the software development lifecycle
• Collaborate with development teams to drive the adoption of security tools and processes, fostering a culture of security awareness and shared responsibility
• Advocate for and gain buy-in from engineering stakeholders to implement security changes and improvements within existing development processes
• Assist teams in reproducing, triaging, and addressing application security vulnerabilities
• Partner with DevOps to ensure a robust and secure code delivery pipeline
• Own our Vulnerability Disclosure Program, ensuring dazzling service to third-party security researchers
• Assist in the development of security processes and automated tooling that prevent entire classes of security vulnerabilities
• Implement an auditable Application Security program (BSIMM, SAMM, etc.)