Incident Response Product Security Engineer II

Esri's Software Security and Privacy team is seeking an Incident Response Product Security Engineer to protect their technology and ArcGIS platform. In this role, you will identify, analyze, and respond to security and privacy risks by implementing incident response frameworks, validating security findings, and collaborating with engineering and product teams to drive security improvements.

• Implement and advance the Incident Response Lifecycle using the FIRST PSIRT Framework
• Validate, research, and translate security and privacy findings into concise issues
• Facilitate red-teaming exercises to evaluate application security posture
• Identify common patterns of vulnerability and privacy risk exposure across products
• Write and maintain standard operating procedures, processes, and best-practice documentation
• Effectively communicate security and privacy risk metrics and investigation outcomes to stakeholders

• 2+ years of experience with CSIRT, CIRT, or PSIRT functions in an enterprise-scale environment
• Solid understanding of FIRST, OWASP Top 10, SANS Top 25, CVE, and related security frameworks
• Experience with Burp Suite or similar automated security testing tools
• Deep knowledge of Windows, Linux, cloud computing, and networking concepts
• Deep understanding of common security weaknesses, attack and defense methodologies
• Strong written and verbal communication skills with proven attention to detail
• Bachelor's degree in computer science, engineering, information systems, data science, or related field
• Authorization to work for any employer in the U.S. (visa sponsorship not available)

• Master's degree in computer science, engineering, information systems, data science, or related field
• Experience with red/blue/purple team penetration testing approaches
• Extensive experience with ArcGIS software
• Experience testing AI solutions for security flaws
• Experience creating and testing security controls for FedRAMP or ISO certifications
• Familiarity with coordinated vulnerability disclosure (CVD) processes
• Scripting experience (Python, Perl, Ruby, shell) or coding experience (Java, C++, .Net)

Base salary $91,728–$148,512 USD. Industry-leading health and welfare benefits including medical, dental, vision, life insurance, 401(k), profit-sharing, minimum 80 hours vacation leave, twelve paid holidays.