SENIOR THREAT MODELER

VeriiPro; Tampa (FL); On-site; USD 120,000 - 180,000; Full time

Job summary

VeriiPro in Tampa, FL seeks a cybersecurity-focused engineer to advance threat modeling and develop secure Python-based applications within an agile DevOps team.

You will engage in threat modeling, automation development, and architecture reviews, ensuring secure, scalable solutions using FastAPI, Pytest, Terraform, and Kubernetes in a fast-paced environment.

Qualifications

• 2–5 years of experience across multiple cybersecurity areas as listed in the job description.
• IT experience minimum of 6 years with minimum of 4 years Cybersecurity/Information Security – must have.
• Threat Modeling experience with STRIDE, PASTA, attack trees, ATT&CK.
• Experience working in a cybersecurity role – must have.
• Security practices for authentication, authorization, logging/monitoring, encryption, infrastructure security, network segmentation – must have.
• Scripting and Infrastructure as Code (Terraform, CloudFormation) – must have.
• Jira or other ticketing systems – must have.
• Architectural design/review skills – must have.
• Strong Python and FastAPI expertise; unit testing with Pytest – must have.
• Adherence to Citi-like security standards and SDLC processes – must have.
• Vulnerability identification via CWE/OWASP.
• OS hardening and development concepts (CICD, pipelines, SDLC).
• CDK, GitOps familiarity.
• DevOps/ Agile team experience.
• Knowledge of Docker/K8s/Serverless/Helm.
• Experience with pen testing preferred.
• Experience with Snowflake/MongoDB/Terraform Cloud/GitHub/Databricks.

Responsibilities

• Threat modeling using a documented process.
• Develop automation tools as required.
• Maintain high standards in threat identification and mitigating controls.
• Oversee lifecycle of identified threats and controls.
• Deliver threat models and supporting tasks within timelines.
• Provide feedback and improvements to the threat modeling process.
• Present work to seniors and other technical teams.
• Work with minimal supervision to complete tasks.
• Develop, test, and deploy secure Python-based applications adhering to SDLC.

Skills

Threat modeling

Python

FastAPI

Unit testing with Pytest

SDLC / security SDLC

CI/CD pipelines

Terraform / CloudFormation

Docker / Kubernetes

GitOps

Security architecture review

Attack surface understanding

OWASP/CWE knowledge

Karat assessment (Python)

Tools

Terraform Cloud

GitHub

Databricks

Snowflake

MongoDB

Job description

Technical skills

• Expected to have two to five years of experience in several of the following:
• IT experience minimum of 6 years with minimum of 4 years Cybersecurity/Information Security – must have.
• Threat Modeling (STRIDE, PASTA, Attack trees, tooling, Att&ck) – must have demonstrated experience.
• Experience working in a cybersecurity role – must have.
• Security practices pertaining to authentication, authorization, logging/monitoring, encryption, infrastructure security, network/segmentation – must have.
• Scripting languages, Infrastructure as Code (Terraform, CloudFormation) – must have.
• Jira or other ticketing systems – must have.
• Design and review technical architectures – must have.
• Strong proficiency in Programming Languages, with a preference for Python (asynchronous programming), and FastAPI (must have).
• Unit Testing: Developing and executing unit tests using frameworks like Pytest to ensure code quality (must have).
• Ensure all software platforms adhere to Citi's security standards and Software Development Life Cycle (SDLC) processes (must have).
• Identifying vulnerabilities using CWE or OWASP.
• Operating systems and their hardening.
• Development concepts (such as: CICD, Pipelines, SDLC).
• Cloud Development Kit (CDK), GitOps.
• Operating in a DevOps / agile team structure.
• Understanding of docker/K8S/serverless/helm.
• Support or perform pen testing.
• Snowflake/MongoDB/Terraform Cloud/GitHub/Databricks.
• Karat Assessment (Python focus) is required for consideration.

Roles & Responsibilities

• Threat Modeling using a documented process.
• Development of automation tools as required.
• Maintain a high standard of work in identifying threats and specifying mitigating controls.
• Attending to the lifecycle of identified threats and controls.
• Delivery of threat models and supporting tasks within existing timeframes.
• Provide feedback, support, and improvements to the existing threat modeling process.
• Present work to seniors, the team, and other technical teams.
• Work with little supervision to complete work.
• Develop, test, and deploy secure and efficient Python-based applications, adhering to established SDLC processes and quality standards.