Director, Application and Product Security

Newfold Digital; Canada; Remote; CAD 100,000 - 130,000; Full time

Job summary

A leading web technology company in Canada seeks a passionate technical leader to drive Application and Product Security Engineering. You will lead a team in securing customer applications and product platforms, collaborating with various teams to foster a security-first approach in development. Ideal candidates have hands-on experience and a strong understanding of security principles in application development.

Qualifications

• Ability to communicate security topics and provide direction.
• Experience partnering with engineering teams on security problems.
• Hands-on experience in software engineering projects.

Responsibilities

• Assess security layers across infrastructure and applications.
• Collaboration with teams to threat model secure systems.
• Review source code against secure coding best practices.
• Drive design and implementation of security services.

Skills

Communication of security topics

Problem-solving in security

Hands-on software engineering

Knowledge of Java

Knowledge of Python

Knowledge of JavaScript

Knowledge of SQL

Knowledge of Perl

Knowledge of CI/CD

Job description

Who we are.

NewfoldDigitalisaleadingwebtechnologycompanyservingmillionsofcustomersglobally.Ourcustomersknowusthroughourrobustportfolioofbrands.Wehavesomeoftheindustry'smostprominent and storied go-to-market brands, including Bluehost, HostGator, Domain.com,Network Solutions, Register.com and Web.com. We help customers of all sizes build a digitalpresence that delivers results. With our extensive product offerings and personalized support,we take pride in collaborating with our customers to serve their online presence needs. Thestrengthofourcompanylivesintheintersectionofourpeople,ourcustomers,andourbrands.

We are looking for a passionate and effective technical leader to help drive Application and Product Security Engineering across our development and operations teams who are responsible for our core customer applications and product platforms, including large-scale web hosting, ecommerce and email services. We believe that we can improve our application and product security by integrating a security mindset early in the development lifecycle as our applications and products are being designed, embracing security best practices and instrumentation at all stages of development and deployment.

You will lead a team which will collaborate with other security, operations and software development teams to guide secure architecture, design and implementation, and reduce security risk in the organization through the construction of guardrails and paved paths that empower engineers to make informed security decisions. The threat landscape for our products and services continue to evolve and expand rapidly, and you will be challenged to help solve large-scale, complex problems that have real impact for our customers, our products, and for the larger Internet community.

What you'll do & how you'll make your mark.

• Provide holistic assessments of security layers across infrastructure, application, people, and process.
• Collaborate with product managers, designers, and engineers to threat model and architect secure and resilient systems.
• Review source code against secure coding best practices and contribute security requirements.
• Drive the software design and implementation of security services, tools, and libraries to provide secure defaults to the rest of the organization.
• Promote security remediations in the CI / CD pipeline by building tools and services for engineers to consume.
• Help build the platform that ensures software development at Newfold is safe, easy, and low-risk.
• Champion an internal security culture.
• Help engineers understand how security events impact them.

Who you are & what you'll need to succeed.

Required qualifications

• Ability to clearly communicate security topics and vulnerability classes (e.g. OWASP Top Ten) and provide actionable direction to product teams.
• A record of partnering with internal engineering teams to tackle security problems across an entire stack with empathy and creativity.
• Hands-on experience in software engineering projects.
• We primarily develop in Java, Python, JavaScript, SQL, and Perl.
• Working knowledge of modern development concepts (virtualized environments, containerization, continuous integration + delivery).

Preferred qualifications

• 5 to 10+ years of experience in application security or product security roles.
• Practical understanding and experience with shared and dedicated web hosting at scale.
• Proven professional experience guiding software teams on secure architecture design.
• Working knowledge of network architecture and system architecture, including cloud infrastructure.
• Experience building or reviewing threat models and ability to craft malicious user, attacker, and abuse / misuse cases.
• Working knowledge of hardware and software supply chain security.

This Job Description includes the essential job functions required to perform the job described above, as well as additional duties and responsibilities. This Job Description is not an exhaustive list of all functions that the employee performing this job may be required to perform. The Company reserves the right to revise the Job Description at any time, and to require the employee to perform functions in addition to those listed above.