Senior Security Engineer

Senior Security Engineer will design, implement, operate, and continuously improve security technologies and controls, with a focus on application security across the SDLC and CI/CD.

• Develop and maintain software application security policies and procedures
• Implement software application security controls
• Partner with Dev Ops to develop a secure CI/CD pipeline
• Design and operate web application firewall (WAF) and API protections
  ; tune rules, reduce false positives, and automate policy updates
• Identify application security vulnerabilities and issues; perform risk assessments and deliver mitigations
• Develop security monitoring for the application stack
• Conduct technical investigations of application security incidents
• Interface with senior stakeholders across the IT leadership team to interpret risks and priorities proactively
• Support the organization’s diversity and inclusion strategy by following policies and procedures that ensure opportunities for employees and diverse business partners
• Assist with other job duties as assigned

• 6 to 8 years of experience in Application Security (designing, implementing, and operating security controls in enterprise application environments)
• Hands-on web application security experience, including OWASP Top 10 vulnerabilities
• Hands-on WAF/API security experience (policy design, rule tuning, automation)
• Hands-on container security experience (runtime hardening, image scanning, vulnerability risk assessments)
• Hands-on experience conducting web application security scans, vulnerability assessments and/or penetration testing
• Experience investigating problems and processes using established methodologies and best practices
• Experience working with Authentication and Authorization services such as OAuth and OpenID
• Experience operating on-prem or cloud-based security platforms
• Ability to troubleshoot security and network-related issues and communicate technical findings effectively
• Ability to listen and integrate ideas from diverse groups, build respectful relationships, collaborate, and resolve conflicts constructively
• Bachelor’s Degree in Information Security or Computer Science or Computer/Electrical Engineering, and/or equivalent field experience
• Proof of eligibility to work in the United States

• Embed application security into the SDLC and CI/CD pipelines
• Strengthen web/API protections and enable proactive detection
• Contribute broadly to Security Engineering capabilities, including identity, cloud/on-prem security platforms, logging/telemetry, and automation
• Partner closely with development, Dev Ops, and operations teams to support secure-by-default applications and services

• Integrity through accountability, consistency, transparency and trust
• Agility through adaptability, continuous improvement, expertise, and flexibility
• Partnership through collaboration, communication, leadership, and teamwork
• Inclusivity through diversity, relationships, respect, and support

• Reston, VA (onsite)

• USD 140, per year

• OWASP Top 10
• Web application firewall (WAF)
• OAuth
• OpenID