Software Security Engineer

INP - Deporte Virtual; United States; Teletrabalho; USD 120 000 - 200 000; Tempo integral

Resumo da oferta

INP - Deporte Virtual is seeking a Senior Software Security Engineer to strengthen software security across the product lifecycle, from threat modeling and secure architecture to security testing, vulnerability management, compliance, and incident response.

The ideal candidate will partner with software development teams to embed security into the SDLC while ensuring products meet cybersecurity and regulatory requirements.

Qualificações

• Experience in Software Security, Product Security, or Application Security.
• Solid understanding of secure software architecture and SDLC security.
• Hands-on experience with threat modeling, vulnerability management, security testing, and secure coding practices.

Responsabilidades

• Perform cybersecurity assessments, asset identification, threat modeling, and software risk classification.
• Design and implement secure software architectures and integrate security controls throughout the SDLC.
• Develop secure coding guidelines, tools, and best practices for development teams.
• Establish and maintain secure authentication and authorization mechanisms.
• Define, review, and translate security requirements into software requirements and security baselines.
• Ensure compliance with standards and regulations such as ISO 27001, IEC 62443, GDPR.
• Conduct security reviews of software architecture, interfaces, third-party components, and SOUP/OTS.
• Verify security requirements through code audits, software validation, and security testing.
• Plan and support attack surface analysis, malformed input testing, software composition analysis, vulnerability testing, and security patch testing.
• Conduct or coordinate penetration testing and static/dynamic code analysis.
• Maintain and review SBOMs and CBOMs, MDS2 forms, product security documentation, and security whitepapers.
• Provide security awareness training and secure coding workshops.
• Act as a central security contact for development teams during security incidents and vulnerability remediation.
• Monitor emerging cybersecurity threats and technologies and recommend improvements to product security.

Conhecimentos

Software Security

Threat Modeling

Secure SDLC

Security Testing

Vulnerability Management

SBOM/CBOM

Descrição da oferta de emprego

We are looking for a Senior Software Security Engineer to strengthen software security throughout the product lifecycle, from threat modeling and secure architecture to security testing, vulnerability management, compliance, and incident response.

The ideal candidate will work closely with software development teams as a security partner, helping embed security into the Software Development Lifecycle (SDLC) while ensuring products meet relevant cybersecurity and regulatory requirements.

Key Responsibilities

• Perform cybersecurity assessments, asset identification, threat modeling, and software risk classification.
• Design and implement secure software architectures and integrate security controls throughout the SDLC.
• Develop secure coding guidelines, tools, and best practices for development teams.
• Establish and maintain secure authentication and authorization mechanisms.
• Define, review, and translate security requirements into software requirements and security baselines.
• Ensure compliance with standards and regulations such as ISO 27001, IEC 62443, GDPR, and applicable medical device security requirements.
• Conduct security reviews of software architecture, interfaces, third-party components, and SOUP/OTS.
• Verify security requirements through code audits, software validation, and security testing.
• Plan and support attack surface analysis, malformed input testing, software composition analysis, vulnerability testing, and security patch testing.
• Conduct or coordinate penetration testing and static/dynamic code analysis.
• Maintain and review SBOMs and CBOMs, MDS2 forms, product security documentation, and security whitepapers.
• Provide security awareness training and secure coding workshops.
• Act as a central security contact for development teams during security incidents and vulnerability remediation.
• Monitor emerging cybersecurity threats and technologies and recommend improvements to product security.

Ideal Profile

• Strong experience in Software Security, Product Security, Application Security, or Cybersecurity Engineering.
• Solid understanding of secure software architecture and SDLC security.
• Hands-on experience with threat modeling, vulnerability management, security testing, and secure coding practices.
• Experience translating security requirements into actionable software and development requirements.
• Knowledge of security standards and regulatory frameworks, particularly ISO 27001, IEC 62443, and GDPR.
• Experience with SBOM/CBOM, SCA, SAST/DAST, penetration testing, and attack surface analysis.
• Strong communication skills and the ability to work directly with software engineering and development teams.
• Experience in medical devices or other highly regulated environments would be highly valuable.