Sr. Information Security Engineer

Overview

Position not eligible for sponsorship.
Locations:
Onsite in Memphis, TN;
Maryville, TN;
Birmingham, AL;
Lafayette, LA;
New Orleans, LA;
Charlotte, NC;
Raleigh, NC; or Dallas, TX.

This role focuses on comprehensive application security testing and vulnerability management across the software development lifecycle. It involves conducting automated and manual scans using tools like Invicti, Veracode, and Burp Suite to identify and remediate security flaws in application code and open-source components. The position requires strong collaboration with development and Dev Ops teams, secure coding expertise in languages such as Java and Python, and adherence to compliance frameworks including NIST, PCI-DSS, and SOX.

The ideal candidate brings over five years of hands-on experience in application security, secure development practices, and automation within CI/CD environments.

• Application Security Testing & Analysis:
  Conduct SAST scans using Veracode to identify vulnerabilities in source code.
• Application Security Testing & Analysis:
  Conduct SCA scans using Veracode to identify vulnerabilities in open-source components.
• Application Security Testing & Analysis:
  Analyze scan results, identify root causes, and collaborate with developers to implement effective remediations.
• Application Security Testing & Analysis:
  Work with CI/CD pipelines to integrate security testing into Dev Ops workflows.
• Application Security Testing & Analysis:
  As-needed, conduct manual verification and secondary authenticated scans using Burp Suite to reduce false negatives.

• Software Development & Secure Coding Knowledge:
  Understand and evaluate vulnerabilities in Java, .NET, Python, and other application codebases.
• Software Development & Secure Coding Knowledge:
  Work with development teams to remediate security flaws in source code and follow secure coding practices.
• Software Development & Secure Coding Knowledge:
  Provide guidance on OWASP Top 10 and SANS 25 vulnerabilities, including how they arise, how to exploit them, and how to prevent them.
• Software Development & Secure Coding Knowledge:
  Able to perform scripting and coding in Java and Python as-needed for security engineering.

• Vulnerability Management & Compliance:
  Ensure required DAST, SAST, and SCA release and periodic scanning is occurring and that scans and findings are addressed within SLA.
• Vulnerability Management & Compliance:
  Review and approve false positives and mitigated-by-design requests for DAST, SAST, and SCA.
• Vulnerability Management & Compliance:
  Review and approve SDLC tasks (MME and SbD MUFG processes) for DAST, SAST, and SCA.
• Vulnerability Management & Compliance:
  Maintain compliance with NIST, PCI-DSS, FFIEC, SOX, CIS security frameworks.
• Vulnerability Management & Compliance:
  Store and organize security artifacts in archives, following standardized documentation practices.

• Security Collaboration & Process Improvement:
  Work closely with developers, Dev Ops teams, and application owners to secure software at all stages of SDLC.
• Security Collaboration & Process Improvement:
  Work with Security teams to deploy security tools as IAC.
• Security Collaboration & Process Improvement:
  Stay updated on the latest exploitation techniques, security research, and industry best practices.
• Security Collaboration & Process Improvement:
  Knowledgeable around securing cloud workloads and cloud instances within AWS, Google, and Azure.
• Security Collaboration & Process Improvement:
  Support the Cyber Incident Response Team (CIRT) in the effective detection, analysis, and containment of attacks.
• Security Collaboration & Process Improvement:
  Design, test and develop specific content and alerting to identify threats against their critical assets.

• Bachelor s degree in Computer Science, Cybersecurity, or related field (or equivalent experience).
• Relevant security certifications (e.g., OSCP, OSWE, GWAPT, CEH) are highly desirable.
• 5+ years of experience in Application Security, Secure Development, DAST, and SAST.
• Hands-on experience with DAST tools such as Veracode (Netsparker), App Scan, Burp Suite, Acunetix.
• Experience with SAST tools…