Security engineer in digital

One View is looking for a Senior Security Engineer to join our Dev Sec Ops  team and own the growth and ongoing management of our Info Sec program, covering cloud-hosted applications and infrastructure, security culture, and customer security requirements.

• Set the requirements for automated threat detection, response, and remediation in our cloud-hosted environments, choose the tooling with our platform engineers, and own the detection rules and response procedures it runs.
• Lead internal threat assessments of our environments.
• Assess our environments and security program against industry frameworks such as the CIS Benchmarks and the NIST Cybersecurity Framework.
• Review our external attack surface, including what public sources reveal about One View.
• Design remediation plans and policies for security vulnerabilities.
• Write each fix as a backlog item with acceptance criteria and the evidence that will show it is complete, and give the team's technical product owner the risk assessment needed to rank it.
• Set the application security testing standards for development teams, including the automated security tests that run in our pipelines and the results a change must meet before release, and review findings with the engineers who fix them.
• Implement security controls in Terraform when that work is assigned to you, and review infrastructure as code changes that affect security.
• Plan and run the independent security assessments our customers require, such as penetration tests and third-party security assessments, and those we commission ourselves.
• Agree the scope with the assessor, and with the customer where they require it, act as One View's point of contact during the assessment, and track each finding to closure.
• Lead security incident response, and act as the first escalation point for security incidents.
• Own external security audits of One View end to end.
• Define and compile the evidence each control needs, attend the sessions with the auditors, answer their questions, and decide which information is appropriate to provide.
• Represent our security posture to customers through security reviews, questionnaires, due diligence, and follow-up discussions with the customer's security team.
• Identify platform security investments before anyone requests them, build the case for what each one is worth, and take it through the team's technical product owner to the Sr. Director and the executives who fund the work.
• Once it is approved, specify the work and verify the result.
• Explain security issues to engineers who need to change something, delivery leads who need to plan around it, and executives who need to decide, at the depth each one needs.

7+ years in software or cloud security with a hands-on engineering background, with working experience in each of the following areas, using one or more of these or comparable tools:

• Cloud platforms: AWS, Google Cloud, Microsoft Azure
• Infrastructure as code:
  Terraform with Terragrunt, Cloud Formation
• CI/CD:
  CircleCI, Git Hub Actions, Git Lab CI/CD
• Security testing (static analysis, software composition analysis, container scanning, and infrastructure as code scanning):
  Snyk, Semgrep, Sonar Qube, Checkmarx, Veracode, Trivy, Checkov
• Cloud security services: AWS Security Hub, Amazon Guard Duty, Google Security Command Center
• Detection and logging:
  Splunk, Elastic, Datadog, Microsoft Sentinel, Google Security Operations
• Has built or specified security gates in CI/CD pipelines that stop a change that fails a security requirement.
• Has hands-on experience with infrastructure as code guardrails, secrets and key management, and policy as code.
• Has prepared the evidence for an external security audit or certification, such as ISO 27001, PCI DSS, Cyber Essentials…