Senior Software Security Engineer, Affinity

• You have 8+ years of experience working in backend software engineering, with at least 5+ years of acting as a senior security engineer, leading complex, cloud software security projects across teams
• Experience performing source code-enabled security assessments, root cause, and adjacency analysis
• Knowledge of OWASP top 10 and other standards like NIST SP 800-64
• You have experience writing server-side code leveraging modern OOP practices using Ruby, and PostgreSQL
• Strong communication and collaboration skills to work effectively with cross-functional teams and influence product security
• You're excited to work collaboratively within engineering and as part of a cross-functional team

Desirable

• As a Senior Software Security Engineer, you will play a pivotal role in safeguarding our organization's digital assets by designing, implementing, and maintaining robust security solutions
• You will focus on application security, vulnerability management, cloud security, vendor security, and ensuring security and privacy by design principles are embedded throughout the software development lifecycle
• You will work closely with cross-functional teams, including Engineering, DevOps, and Product, to influence and execute security roadmaps and foster a culture of security-first thinking
• Collaborate with engineering teams to promote secure coding practices and integrate security tools into the CI/CD pipelines
• Collaborate with product and engineering teams to ensure security and privacy considerations are integrated into every phase of the SDLC
• Collaborate on development projects to build or enhance security features, create security roadmaps aligned with best practices and customer expectations, and guide product owners on threat modelling and attack surface analysis
• Perform static and dynamic application security testing (SAST/DAST) and perform vulnerability assessments to ensure secure development and delivery
• Define and embed security requirements throughout the development lifecycle, ensuring they are effectively implemented and aligned with organizational security standards
• Review application and system designs to ensure security requirements are appropriately traced, validate implementation plans, and recommend improvements to enhance the overall security posture
• Provide security guidance in implementing enterprise security technologies (such as DNS, Email, and Secure file transfers)
• Ensure the effective operation of enterprise security tools and technologies, including 2FA/MFA for resource access, SIEM/SOAR/EDR, and endpoint security
• Certificate lifecycle management; Security configuration and vulnerability assessment
• Facilitate, promote, and perform secure code reviews to identify and mitigate vulnerabilities effectively
• Identify, assess, and prioritize vulnerabilities across infrastructure, applications, and cloud environments, managing triage and resolution of security defects in collaboration with engineering teams
• Establish processes and capabilities to respond effectively to externally reported product vulnerabilities, ensuring timely mitigation and stakeholder communication
• Develop detailed risk reports and remediation plans, while managing third-party component vulnerabilities and implementing a robust program for external evaluation, including a bug bounty strategy
• Assist in security vulnerability identification and management
• Build and maintain a consolidated security architecture roadmap for Product, SaaS Operations and Enterprise (internal Information Technology systems and 3rd party vendors)
• Assess/review cloud security measures, ensuring proper configuration and use of CSPM and CWP tools across environments like AWS
• Assist in investigating security breaches, misuse of computer resources, and other violations of information security policies and technology standards
• Evaluate third-party vendors to ensure their security offerings align with our organization's requirements and standards
• Manage compliance with external security standards (ISO-27001, SOC 2 etc.) and coordinate internal resources for external audits as needed
• Lead threat modelling sessions to identify potential risks in system designs
• Assist Senior Management in defining the overall information security strategy
• Develop frameworks and best practices to improve the organization’s security posture