Principal Security Engineer, GoDaddy

• Do you want to be an Information Security Leader at GoDaddy? We help solve large-scale and cross-company issues while ensuring that partnership with the development and operational communities remain front of mind
• You must be comfortable communicating with internal teams and external auditors, designing and leading security campaigns, and prioritizing the resolution of audit findings while applying a risk-based approach
• 10+ years of professional experience in Information Security or related fields such as Information Technology, IT Audit, etc
• 6+ years of dynamic experience managing programs related to information security and information security audits
• Experience building unified security controls frameworks
• Experience managing audits applying compliance frameworks such as PCI DSS, NIST CSF, NIST 800-53, ISO, SOC-2 etc
• Executive reporting on the status of security programs and campaigns
• Experience in Security Engineering concepts such as Threat modeling and architecture reviews
• Experience with auditing cloud infrastructure such as AWS
• We encourage you to apply even if your experience or skillset doesn’t align perfectly with every requirement. We value a wide range of backgrounds and transferable skills, and we are excited to support learning and growth

Desirable

• GoDaddy is looking for a Principal Risk Engineer with security risk management experience, technical depth, strong leadership abilities, and experience building and performing information security audits and gap assessments
• As a team, we will help identify any gaps in security control implementation, design solutions to manage security risks at scale, and provide the information needed to make risk-based decisions and planning
• Build and manage a Security Controls framework that encompasses the regulatory and industry compliance frameworks we follow
• Perform targeted gap assessments to identify any deviations from the control framework
• Propose and manage enterprise-wide security campaigns for managing deviations to reduce risk
• Partner with other InfoSec teams and Engineering teams to define and prioritize security initiatives and investments guided by risk assessment principles
• Align risk management initiatives with applicable compliance regulations