Application Security Architect (EU/IN)
- Remote from Europe or India, EU/India
We are looking for an Application Security Architect based in Europe or India to work for one of our clients, a multinational corporation that provides IT services, including digital, technology, consulting and operations services. The person in this role will work with a team based in Espoo, Finland.
The person in this role requires someone who can stand up a secure CI/CD pipeline and work with product teams to secure applications.
- Work with infrastructure and development teams to define the strategy for and integrate, implement, and maintain security tools in the CICD pipeline leveraging automation to ensure SAST, DAST, etc. are part of the overall model
- Coordinate security testing of solutions including result analysis and driving of remediation (SAST, DAST, IAST, RASP, VM, and penetration testing)
- Work with the application and solution teams to secure SaaS and on-premise applications including assisting in the overall architecture and design of the solution and supporting components
- Ensure that applications developed meet our client’s security policies and requirements, contractual obligations, and legal and regulatory requirements.
- Day-to-day work with client delivery teams and ensure that they adhere to our client’s corporate information and application security architecture, policies, procedures, baselines and guidelines. This is role requires a mix of technical capabilities as well as the know-how to provide security governance over complex applications and projects while also having the ability to articulate complex security concepts to business personnel and non-security personnel
- Engage with resources across governance, compliance, and technical architects during the lifecycle of a project, supporting the sales cycle, to interacting with prospective clients and client teams to usher in, and provide security assurance, guidance, and advisory
- Serve as a Cybersecurity resource and SME for a Product and Platform centric organization ensuring that secure coding practices, security architecture, and governance are integrated with solutions during development while also ensuring that security is designed into actual services from the inception of the project to production and client delivery
- Interface with Digital business leaders, client architecture teams, corporate architecture and governance personnel
- Ability to translate technical risk issues and distill such issues to common IT business leaders and upper management
- Work with program managers to develop project plans, estimation documents, specifications, diagrams, and flowcharts
- Solid understanding of security vulnerabilities (OWASP, CVE scoring) and experience working with development and product teams to remediate vulnerabilities during development cycles.
- Solid understanding as to how to mitigate risks with common controls such as WAF’S, IDPS’s, MPS’s, AWL, etc.
- Implement common principles and practices across cloud platforms and provide compliance with industry specific guidelines such as the Security Trust and Assurance Registry from the Cloud Security Alliance.
- Advanced Level of English
- Bachelor’s Degree in Computer Science, Systems Engineering or related fields
- 7+ years of security architecture responsibility and progressive information security experience across various information security/information technology risk management domains
- 7+ years of IT experience (including hands-on knowledge of network and distributed systems) and a sound understanding of networking concepts
- 5+ years performing risk assessments including experience with SAST/DAST tools, Vulnerability Remediation, Controls Mapping, Audit Protocols, Applications, Databases, Virtual Networks, Servers, Domains, SaaS, Cloud, Encryption, Firewalls, DLP, IAM Solutions, and security testing.
- Experience coordinating third-party penetration testing and working with development teams and product teams to drive remediation of findings.
- Experience implementing security testing tools (i.e. Fortify, BlackDuck, Accunetix, Burp, etc.) and integrating them with workflow and development platforms (i.e. Jira, Jenkins, etc.)
- Experience implementing secure solutions in public cloud environments (AWS/Azure/GCP) in alignment with ISO 2700, CSA, ISF, and NIST compliance
- Strong experience in public cloud solutions, services and practices including PaaS, IaaS, and SaaS products and services
- Understanding of network design principles with and knowledge of virtualized environments and implementation of security controls in a virtual infrastructure.
- Implement application security best practices according to industry-recognized standards and frameworks such as OWASP, SANS, CIS
- Understanding of current information security solutions market and vendor spaces across broad security domains
- Work with development teams to ensure that appropriate assessment of security risks is performed. This role requires a mix of technical capabilities as well as the know-how to provide security oversight for complex applications and articulate security concepts to developers
- Strong communication and presentation skills. Ability to present complex compliance issues in an easy to understand manner for executive management.
- Strong team player that collaborates well with others to solve problems and actively incorporate input from various sources.
- Certification in one or more of the following is required: CISSP (Certified Information Systems Security Professional), CEH (Certified Ethical Hacker), CISA (Certified Information Systems Auditor), CISM (Certified Information Security Manager, or GIAC (Global Information Assurance Certification)
- Experience with IAST and RASP tools
- Penetration Testing
Friday, September 11, 2020