Application Security Specialist

Title:
Application Security Specialist
Location:
Cambridge, MA
Duration: 6 Months (Extendable)

• Creating application security related policies & processes
• Creating RFP for selecting a service provider for application security
• Analysing RFP results and presenting to stakeholders
• Coordinate vendor product demonstrations and presentations
• Analysing application security products from various vendors
• Conducting pilot or POC with selected vendors for threat modelling, architecture reviews, code scanning and penetration testing
• Collaborating with cross functional teams and getting their buy in for managed project deadlines.

• Good mediation and facilitation skills
• Good knowledge of IT Project Management
• Experience with compliance and security requirements related to medical devices, including data privacy.
• Knowledge of risk management standards or frameworks such as COSO, ISO 2700x, CobiT, ISO 24762, BS 25999, NIST, ISF Standard of Good Practice and ITIL
• Knowledge of OWASP, SDLC, Encryption, Identity and Access Management, data integrity measures
• Capability to design application security related policies and processes with deep knowledge of integration between Security and system development life cycle
• 10+ years of working experience
• 3+ years as an IT security expert
• Broad and in-depth technical, analytical and conceptual skills
• Experience in reporting to and communicating with senior level management
• Excellent written and verbal communication and presentation skills; interpersonal and collaborative skills; and the ability to communicate information risk-related concepts to technical as well as nontechnical audiences, and to audiences with a risk management profile as well as those with a less outspoken risk management profile.
• Excellent understanding and knowledge of general IT infrastructure technology, systems and management processes
• Proven experience to create new processes or improve existing process
• Application Security, Application Architecture and MS-Office proficiency
• Understanding of OWASP top 10 and SANS 25
• Professional information security certification, such as CISSP, CISM or ISO 27001 auditor/practitioner is preferred.
• Professional (information system) risk or audit certification such as CIA, CISA or CRISC is preferred.

Undergraduate in Computer Science or relevant field is required;
Master’s degree is preferred.

All your information will be kept confidential according to EEO guidelines.