We are seeking a talented Security Engineer to join our team. The ideal candidate should have a strong background in production security, DevSecOps, and extensive experience with SDLC practices and multiple security tools, including but not limited to Qualys, Black Duck, and Prisma. As a Security Engineer, you will be responsible for ensuring robust security practices and implementing cutting-edge security measures to protect our systems and data.
- Vulnerability Management:
Own end-to-end vulnerability lifecycle for a given Business Unit consisting of multiple enterprise level products. (SaaS & on-prem).
Triage, track, Correlate and remediate vulnerabilities from tools like Black Duck, Prisma Cloud, Qualys, Jfrog Xray etc. Understanding the working of these tools and mapping in a common tool.
Co-ordinate with business security leads to plan patching strategies and risk mitigation.
- Security Automation:
Integrate security scanning tools into common tools.
In progress and SLA tracking for all the vulnerabilities and work closely with respective business units.
Develop dashboards and reports for compliance and leadership visibility.
Write high level design to automate a few of the manual work.
- Collaboration & Governance:
Work cross-functionally with product teams, and stakeholders.
Contribute to security policies, standards, and best practices.
Participate in incident response and post-mortem analysis.
- Education & Awareness:
Publish security advisories on high-priority vulnerabilities (CVEs).
Helping Junior team members on security aspects.
Kubernetes, container build pipeline, and repository platform knowledge is a plus.
Familiarity with vulnerability scoring models like CVSS,EPSS,BDSA
Requirements
Security Tools: Black Duck, Prisma Cloud, Qualys, Snyk, Coverity, SonarQube, Nessus
DevOps Stack: Jenkins, Kubernetes, Helm, Docker
Programming: Python, Shell, YAML, JSON (Good to have)
Cloud Platforms: AWS, GCP (Understanding basics of Cloud) Success Metrics
Reduction in high/critical vulnerabilities within SLA by working with security champion
Increasing automation for doing mundane tasks
Cross-team security engagement and support effectiveness
Strong communication skills.
