Senior App Security & DevSecOps Analyst

The Estée Lauder Companies Inc.; New York (NY); Vor Ort; USD 90.000 - 135.000; Vollzeit

Benefits dieser Stelle

Health insurance

Retirement savings plan

Paid time off

Education programs

Zusammenfassung

The Estée Lauder Companies Inc. is a global leader in luxury beauty products, seeking a role to drive application security across the SDLC. You will evangelize secure software practices, mentor teams, and coordinate DevSecOps initiatives in a multi-site environment.

The role emphasizes vulnerability management, cloud and container security, and collaboration with R&D, IT, and security stakeholders to deliver trusted products to clients and partners.

Qualifikationen

• Good knowledge and understanding of application security vulnerabilities (SANS, OWASP).
• Knowledge of Threat modelling and risk analysis.
• Candidate should be very thorough in internet technologies and highly versed with web development best practices.
• Strong analytical/problem solving skills and cross functional knowledge across multiple development and security disciplines.
• Understanding of Test Automation tools and frameworks such as SAST, DAST, IAST.
• Ability to communicate security-related concepts to a broad range of technical and non-technical staff.
• Must possess a high degree of integrity, be trustworthy, and have the ability to lead and inspire change.
• Previous software engineering/architecture experience (Java, C#,.Net, JavaScript) preferred.
• Understanding CI/CD pipelines covering source control, integration, and deployment (ex: Bitbucket, Jenkins, JIRA, Artifactory, Nexus, git).
• Knowledge in securing cloud deployment and containers (familiarity with Ansible, DeMisto, Docker, and/or Kubernetes).
• Some experience with development of RESTful and SOAP web services preferred.
• Understanding of advanced iterative Agile methodologies.
• Familiarity with micro services architecture and design Patterns.

Aufgaben

• Review current security processes used in our Software Engineering teams & develop optimization strategies.
• Work with the development teams to coordinate and perform vulnerability assessments through the use of automated and manual tools.
• Provide consulting & mentoring expertise to our Developers, DevOps, and Software Engineering teams in a dynamic environment to promote and implement the DevSecOps program across our organization.
• Ability to review and analyze vulnerability data to identify security risks to the organization's network, infrastructure, and application's and determine any reported vulnerabilities that are false positives.
• Provide the expertise to prepare security vulnerability and risk management reports for management and other key stakeholders.
• Ensure we deploy best practice Cloud Configuration and Security Management tools and processes into our Software Engineering teams.
• Provide leadership and teaming skills to coordinate remediation of vulnerabilities within established timeframes.
• Experience operating in agile development processes and integrating secure development practices into these models.
• Excellent programming and scripting skills in languages such as C#, C/C++, Java, JavaScript, PowerShell, Python, etc.
• Experience with APIs: REST, SOAP, SOA and other integrations
• Formal training in the primary development toolset: Tools, Code, Application Engine, SQL/DB Security.

Kenntnisse

Good knowledge of app security (SANS,

Threat modelling & risk analysis

Analytical & cross-functional skills

Communicate security concepts to broad

Understanding CI/CD pipelines

Tools

SAST

DAST

IAST

Bitbucket

Jenkins

JIRA

Artifactory

Nexus

git

Docker

Kubernetes

Ansible

Demisto

Jobbeschreibung

The Estée Lauder Companies Inc. is a global leader in luxury beauty products, seeking a role to drive application security across the SDLC. You will evangelize secure software practices, mentor teams, and coordinate DevSecOps initiatives in a multi-site environment.

The role emphasizes vulnerability management, cloud and container security, and collaboration with R&D, IT, and security stakeholders to deliver trusted products to clients and partners.