Product Security Engineer

NSS; Virginia (MN); Remote; USD 100,000 - 130,000; Full time

Job summary

A technology company is seeking a Software Security Engineer to enhance security practices in software development. The role requires over 8 years of experience, including maintaining a secure software supply chain and code reviews. The company offers a remote-first environment with occasional on-site summits and competitive annual reviews.

Benefits

Remote-first environment

Competitive salary

Annual reviews

Work/life balance

Qualifications

• Must have experience maintaining a secure software supply chain.
• Must review code and identify potential security issues.
• Must have over 8 years of relevant experience.

Responsibilities

• Create, evolve, and implement security practices in software development.
• Evaluate security information from trusted resources.
• Guide secure deployment practices for products.

Skills

Experience maintaining a secure software supply chain

Experience evaluating security best practices

Experience reviewing code and architecture

Experience writing internal documentation

Experience with security monitoring infrastructure

Education

8+ years of experience

United States citizenship

Tools

C#

.NET

ASP.NET

AWS security tooling

Job description

Overview

Introduction

We working on a project that tackles the problem of managing large-scale IT networks. We are seeking talented and highly motivated engineers to join us in bringing this project to a larger audience. You would be responsible for helping to create, evolve, document, and implement security development and deployment practices for a product that’s delivered both on-premises as well as to the cloud. This work would include evaluating and disseminating information and recommendations from resources such as NIST, OWASP, MITRE, and other sources of security information and best practices. This work would also include—with the assistance of the rest of the development team—implementing these security controls and practices as part of the software development process, supplying guidance and requirements for deploying our product on-premises, and creating a secure environment for our upcoming cloud offering.

Our product is a .NET Core application (with some TypeScript and Python components) backed primarily by PostgreSQL, that serves both a web frontend and REST API. The application source is hosted in GitLab, and we use merge requests and GitLab CI to manage our code contribution workflows.

Responsibilities and Focus

Things we really need

• Experience maintaining a secure software supply chain (monitoring for CVEs, creating SBOMs, etc.)
• Experience evaluating security best practices and applying them to processes and assets
• Experience reviewing code and architecture to identify potential security issues
• Experience writing internal documentation around security evaluations and decisions
• Experience with security monitoring infrastructure (log analysis, web application firewalls)
• United States citizenship
• 8+ years of experience

Things we want too

• Familiarity with writing infrastructural code in support of security goals (abstractions, constraints, etc.)
• Familiarity with working with developers to help them learn and self-apply secure development principals
• Familiarity with government/industry security auditing processes
• Specific familiarity with web security concepts and best practices (TLS/HTTPS, common web vulnerabilities, federated authentication, etc.)

Things that are extra cool

• Specific familiarity with government programs pertaining to secure application development (STIGs, APL, NIAP)
• Specific experience with the Microsoft web application development stack (C#, .NET, ASP.NET)
• Specific experience with AWS security tooling
• Experience with static application security analysis tools

Our end of the bargain

• Remote-first environment (if that's your thing)
• Dedicated collaborative office space in NoVA (if that's your thing)
• We respect work/life balance
• Occasional on-site team summits
• Competitive salary and annual reviews