Security engineer in digital commerce

OneView Commerce; United States; Remote; USD 140,000 - 190,000; Full time

Job summary

OneView Commerce ищет старшего инженера по безопасности (Senior Security Engineer) для части DevSecOps. Вы будете владеть ростом и управлением программой InfoSec, работать с облачными приложениями и инфраструктурой, развивать культуру безопасности и удовлетворять требования клиентов.

Ваша работа включает настройку обнаружения угроз, руководство оценками угроз, взаимодействие с аудиторией аудитов и аудитами на соответствие ISO/Pci/SOC2.

Qualifications

• 7+ лет в области обеспечения безопасности ПО или облака с hands-on опытом в инженерии.
• Знание CI/CD и инструментов автоматизации, включая Terraform/ Terragrunt и CloudFormation.
• Опыт проведения независимых аудитов безопасности и подготовки доказательств для сертификаций (ISO 27001, PCI DSS, SOC 2).
• Опыт ведения инцидент-реакций и взаимодействия с заказчиками по вопросам безопасности.

Responsibilities

• Определять требования к автоматическому обнаружению угроз и рaзрабатываeть механизмы реагирования.
• Проводить внутренние оценки угроз и соответствия FRAMEWORK CIS/NIST.
• Провести обзор внешней поверхности атаки и взаимодействие с аудитами.
• Разрабатывать планы устранения уязвимостей и приемочные критерии для backlog.
• Устанавливать стандарты тестирования безопасности в pipelines и оценивать результаты.
• Реализовывать меры безопасности в Terraform и контролировать IaC изменения.
• Планировать и проводить независимые аудиты безопасности по требованию клиентов.

Skills

Cloud security

Threat modeling

CI/CD security

Incident response

Stakeholder communication

Tools

Terraform

Terragrunt

CloudFormation

CircleCI

GitHub Actions

GitLab CI/CD

Snyk

Semgrep

SonarQube

Checkmarx

Veracode

Trivy

Checkov

AWS Security Hub

GuardDuty

Google Security Command Center

Splunk

Elastic

Datadog

Microsoft Sentinel

Google Security Operations

Job description

Описание:

OneView is looking for a Senior Security Engineer to join our DevSecOps team and own the growth and ongoing management of our InfoSec program, covering cloud-hosted applications and infrastructure, security culture, and customer security requirements.

Задачи:

• Set the requirements for automated threat detection, response, and remediation in our cloud-hosted environments, choose the tooling with our platform engineers, and own the detection rules and response procedures it runs.
• Lead internal threat assessments of our environments.
• Assess our environments and security program against industry frameworks such as the CIS Benchmarks and the NIST Cybersecurity Framework.
• Review our external attack surface, including what public sources reveal about OneView.
• Design remediation plans and policies for security vulnerabilities.
• Write each fix as a backlog item with acceptance criteria and the evidence that will show it is complete, and give the team's technical product owner the risk assessment needed to rank it.
• Set the application security testing standards for development teams, including the automated security tests that run in our pipelines and the results a change must meet before release, and review findings with the engineers who fix them.
• Implement security controls in Terraform when that work is assigned to you, and review infrastructure as code changes that affect security.
• Plan and run the independent security assessments our customers require, such as penetration tests and third-party security assessments, and those we commission ourselves.
• Agree the scope with the assessor, and with the customer where they require it, act as OneView's point of contact during the assessment, and track each finding to closure.
• Lead security incident response, and act as the first escalation point for security incidents.
• Own external security audits of OneView end to end.
• Define and compile the evidence each control needs, attend the sessions with the auditors, answer their questions, and decide which information is appropriate to provide.
• Represent our security posture to customers through security reviews, questionnaires, due diligence, and follow-up discussions with the customer's security team.
• Identify platform security investments before anyone requests them, build the case for what each one is worth, and take it through the team's technical product owner to the Sr. Director and the executives who fund the work.
• Once it is approved, specify the work and verify the result.
• Explain security issues to engineers who need to change something, delivery leads who need to plan around it, and executives who need to decide, at the depth each one needs.

Требования:

7+ years in software or cloud security with a hands-on engineering background, with working experience in each of the following areas, using one or more of these or comparable tools:

• Cloud platforms: AWS, Google Cloud, Microsoft Azure
• Infrastructure as code: Terraform with Terragrunt, CloudFormation
• CI/CD: CircleCI, GitHub Actions, GitLab CI/CD
• Security testing (static analysis, software composition analysis, container scanning, and infrastructure as code scanning): Snyk, Semgrep, SonarQube, Checkmarx, Veracode, Trivy, Checkov
• Cloud security services: AWS Security Hub, Amazon GuardDuty, Google Security Command Center
• Detection and logging: Splunk, Elastic, Datadog, Microsoft Sentinel, Google Security Operations
• Has built or specified security gates in CI/CD pipelines that stop a change that fails a security requirement.
• Has hands-on experience with infrastructure as code guardrails, secrets and key management, and policy as code.
• Has prepared the evidence for an external security audit or certification, such as ISO 27001, PCI DSS, Cyber Essentials Plus, or SOC 2, and answered the auditors' questions in the audit sessions.
• Knows what to disclose, what to defer, and when to say "I do not know".
• Has scoped an independent security assessment, such as a penetration test, and tracked its findings to closure.
• Has led the response to a major security incident, including containment, stakeholder communication, and the post-incident review.
• Has answered a customer's security team directly, including the people whose job is to test the answers they are given.
• Can explain security to people who are not security specialists.
• Has identified a security investment that had not been requested, built the case for it, and got it funded or scheduled.
• Can describe the argument that worked and the one that did not.

Будет плюсом:

• Has taken a new product through ISO 27001, PCI DSS, or Cyber Essentials Plus certification
• Has worked under a formal data classification scheme set by a customer or a regulator, and knows what each tier requires in practice: data residency, access control, encryption, retention, and who is cleared to handle it. Public sector, defense, financial services, and healthcare regimes qualify
• A security certification such as CISSP, CCSP, OSCP, AWS Certified Security Specialty, or Google Professional Cloud Security Engineer
• Written security documentation, including evidence packs, control narratives, and security policy
• Has incorporated AI into their security practice, for example triaging scan output and drafting control narratives
• Understands how contractual and regulatory restrictions limit what data may be processed by AI tooling, and can explain the operational implications to a team that wants to use it
• Has represented a supplier at a customer's security governance forum, change advisory board, or service review
• Experience of a regulated or public sector engagement where the security posture had contractual or financial consequences
• Has run a security awareness or culture initiative that changed how other teams behaved, and can say how they know it did
• Active in the security community, through conferences, vulnerability disclosure, open source, or research

Условия:

We are a remote-first team with Viewers working across the globe, and we operate as a trusted provider of digital commerce systems for leading retailers. Our teams operate independently. We expect people to identify what should be done differently, and they have the support of their team and of leadership to make the change.