Security Engineer – Cryptography

Darwin Recruitment; Washington (District of Columbia); On-site; USD 120,000 - 170,000; Full time

Job summary

We are seeking a Product Security Engineer for a small, highly technical cybersecurity company. You will combine an offensive-security mindset with genuine software engineering ability, review and audit code, identify vulnerabilities, assess architectures, and remediate issues with engineering teams.

You will operate across product security, application security, offensive security and software engineering, helping ensure new security technologies move from research and prototyping into

Qualifications

• Offensive-security mindset paired with strong software engineering ability.
• Not a traditional penetration-testing role; emphasis on remediation and secure design.

Responsibilities

• Perform security assessments and penetration testing across software products and supporting infrastructure.
• Conduct secure code reviews to identify vulnerabilities and weaknesses.
• Review software architecture from an offensive-security perspective.
• Identify attack surfaces, vulnerabilities and weaknesses before products reach customers.
• Work with software engineers to understand, reproduce and remediate security issues.
• Write code to validate vulnerabilities and build proof-of-concept exploits where appropriate.
• Develop internal security tooling and automate repetitive security testing.
• Conduct threat modelling throughout the software development lifecycle.
• Assess security-sensitive implementations and ensure proper engineering practices.
• Collaborate with research and engineering teams to evaluate new security concepts and technologies.
• Translate technical research into practical product security requirements.
• Contribute to secure development standards and processes as the organization grows.
• Support the wider security architecture and technical direction of new products.

Skills

Offensive security mindset

Software engineering

Code review

Job description

About the Company

We are working with an early-stage cybersecurity company developing a new generation of security products for enterprise and highly security-conscious environments.

The team combines deep security research with hands-on software engineering to solve complex challenges around data protection, secure communications, identity and emerging cyber threats.

As the product portfolio expands, the company is growing its engineering capability and looking for a Product Security Engineer who can help ensure security is embedded into products from the earliest stages of development.

This is a small, highly technical environment where you’ll work closely with senior engineers and researchers and have significant influence over how products are designed and secured.

The Role

We are looking for a Product Security Engineer who combines an offensive-security mindset with genuine software engineering ability.

This is not a traditional penetration-testing role where you’ll simply identify vulnerabilities and produce reports.

You’ll be expected to review and audit code, identify vulnerabilities, assess architectures, write software and work directly with engineering teams to remediate issues.

You’ll operate across product security, application security, offensive security and software engineering, helping ensure new security technologies can move safely from research and prototyping into production.

Put simply, we’re looking for someone who knows how to break software, but also knows how to build it.

Key Responsibilities

• Perform security assessments and penetration testing across software products and supporting infrastructure.
• Conduct detailed secure code reviews to identify vulnerabilities and implementation weaknesses.
• Review software architecture from an offensive-security perspective.
• Identify attack surfaces, vulnerabilities and potential security weaknesses before products reach customers.
• Work directly with software engineers to understand, reproduce and remediate security issues.
• Write code to validate vulnerabilities and build proof-of-concept exploits where appropriate.
• Develop internal security tooling and automate repetitive security testing.
• Conduct threat modelling throughout the software development lifecycle.
• Assess security-sensitive implementations and ensure appropriate engineering practices are followed.
• Work alongside research and engineering teams to evaluate new security concepts and technologies.
• Help translate technical research into practical product security requirements.
• Contribute to secure development standards and processes as the engineering organisation grows.
• Support the wider security architecture and technical direction of new products.