Application Security Engineer, Tyk
Employee share scheme available
Open-source API gateway & management platform
Job no longer available
Open-source API gateway & management platform
101-200 employees
Job no longer available
Employee share scheme available
101-200 employees
Company mission
To connect every system in the world.
Role
Who you are
- A good understanding of API management, Golang, containers (i.e. Kubernetes), distributed cloud providers (AWS, GCP), packages and distros (i.e. Docker), deployment tooling (i..e Terraform, Ansible)
- Deep SDLC knowledge
- Deep security knowledge
- Deep working knowledge of security frameworks and protocols, OWASP, Cyber Essentials etc
- Data led strategy derivation and continuous improvement
What the job involves
- We’re looking for an Application Security Engineer to be responsible for ensuring security from cyber threats and vulnerabilities as well as collaborate with software developers and IT teams to integrate security protocols into the development process and conduct regular security audits to assess and improve the overall security posture of the applications
- Review our current approach to security within the software development lifecycle (SDLC), and building a situation assessment and / or opportunity canvas which allows us to shift left on security
- Build clear and compelling security strategies which reduce our post-launch exposure and our post-launch security rework
- Builda clear set of product security metrics which are used to both provide a health baseline and to demonstrate improvement over time
- Create a best practice policy to ensure security by design, and working with product teams to embed these processes and measure their impact
- Maintain security risk and issue logs for products with the express aim of mitigating security risks before they become issues
- Design and communicate best practice processes and tooling, such as threat modelling and horizon scanning, which allow the product teams to ensure we are identifying risks and have clear plans to mitigate them
- Build a roadmap of vendor upgrades which we need to effect to keep secure, and ensure these are fed into the relevant product domains
- I am creating and maintaining a vulnerability register, and working with product teams to remedy these
- Advise on scanning techniques and tooling (such as OWASP, licensing) which allow us to find and remedy vulnerabilities ahead of code merge
- Work with Operations teams to provide data and answers to support ongoing compliance initiatives, such as SOC2 and ISO
- Respond and update publicly to any of our responsible disclosure programs (Zerocopter, CVEs etc) to ensure Tyk is seen as responsive and responsible
- Assist the QA team with the pen test process, designing pen test scope, transferring results to vulnerability registers, and ensuring product team assessment and resolution of vulnerabilities
- Optimise existing tooling (SonarCloud / Dependabot) and introducing new tooling where appropriate to reduce risk, then work with the product teams for easy adoption
- Run the post mortem process when required for high impact security issues which slip into production, and ensure root cause actions so it never reoccurs
- Assist post and pre sales functions with security queries, or closing gaps identified by customers and prospects
Our take
Tyk offers an API management platform that enables companies to securely share data with third parties, facilitating the sale of services through non-direct channels. This solution helps businesses harness the power of their APIs on a large scale while ensuring data security and accessibility.
The platform acts as both a management and security layer between APIs, simplifying the process for organisations to manage access. By providing a robust security framework, Tyk ensures that only authorised users can interact with an organisation's APIs, thereby protecting sensitive data.
With millions of transactions processed daily for thousands of organisations, including notable clients like AXA, Cisco, Trip Advisor, Starbucks, Domino's, Sephora, and the UK Ministry of Justice, Tyk has established itself as a trusted leader in API management.
Kirsty
Company Specialist at Welcome to the Jungle
Insights
Company
Funding (2 rounds)
Sep 2021
$35m
SERIES B
Apr 2019
$5.4m
SERIES A
Total funding: $40.4m
Company benefits
- Unlimited paid holidays
- Fully remote
- Flexible hours
- Generous parental leave
- Employee share scheme
- Volunteering days
- Sabbatical
- Employee wellbeing
Company HQ
Shoreditch, London
Leadership
Martin Buhr
(Founder & CEO)Previously the Head of Technology and Product Development at Lucky Voice for 3 years and a Technical Architect at LBi for 1 year.
Share this job
View 4 more jobs at Tyk