Specialist, Application Security

Specialist, Application Security (Finance)

Specialist, Application Security (Finance)

Are you interested in building capabilities that enable the organization with innovation, speed, agility, scalability and efficiency? The Global Technology team takes great pride in our culture where digital transformation is built into our DNA! When you join our organization at Prudential, you'll unlock an exciting and impactful career - all while growing your skills and advancing your profession at one of the world's leading financial services institutions.

Your Team & Role

As a Specialist, Application Security in the Application Security team, you will partner with other security professionals across the Information Security Office, the Chief Technology Office, and other engineering groups in Prudential to advance Prudential's application security program. In this role, you would be responsible for efforts to secure modern applications and ensuring "secure by design" development best practices across all digital assets in alignment with industry standards.

You will track and govern risk reduction. You will work with partner organizations to consult on implementation efforts, mature operational processes and enable automation CI/CD controls for enforcement and monitoring. In addition to applied experience, you will bring excellent problem solving, communication and teamwork skills, along with agile ways of working, strong business insight, an inclusive leadership attitude and a continuous learning focus to all that you do.

The ideal candidate will have a deep understanding of modern application architecture, cloud-native security, and Dev Ops practices. Forward-thinking is required for this role to include focus on how to securely develop systems, enable self-service and incorporate capabilities for Security to scale and defend against evolving threats.

Here is What You Can Expect on a Typical Day

• Function as the escalation point for all daily operational work as well as project work from more junior staff on the team.

• Leverage App Sec tool/process specific knowledge to resolve complex technical/process/people problems the team faces.

• Leverage organizational and industry knowledge to bridge gaps between the App Sec/Dev Ops teams and internal IT/business teams to ensure the team has the information and resources they need to meet team goals.

• Partner with leadership to set direction for the future of the App Sec program, while ensuring an accurate understanding and in-depth knowledge of daily operations to provide team recommendations.

• Maturing existing vulnerability and configuration monitoring capabilities for open source, third party and first party code and applications.

• Collaborate with cross functional teams to integrate security best practices into development and operations, implement these as controls.

• Mature and develop /design and assist in implementing security policies and alerting mechanisms in our security stack based on SOX and NIST standards.

• Assist in vetting new software solutions and provide guidance and support to the other teams.

• Employ a variety or qualitative and quantitative analysis techniques to continually improve user experience.

• Promote the adoption of secure-by-design principles and practices throughout the software development lifecycle.

• Validate proper mitigation controls are in place until remediation activities are complete.

• Ensure reporting metrics relay proper risk posture to leadership and evolve as necessary support.

• Revise processes and procedures, metrics, and documentation that continue to improve the App Sec program capabilities.

• Provide proof-of-concept exploits in a lab environment to demonstrate exploitability and provide validation of proposed / implemented remediation actions

• Experience with common vulnerability feeds from government, vendor, and open-source communities

• Understanding of threat actors with the ability to articulate how they operate and demonstrate how they subvert common security controls

• Understanding of the OWASP Top 10. Familiarity with vulnerabilities in 3rd party libraries…