Senior Product Security Engineer

Overview

Designs and implements security best practices across the system development lifecycle, working with cross-functional teams as a security subject matter expert for ConnectWise applications.

What you'll do

• Provide support to cross-functional teams, with high attention to detail.
• Research, analyze, and document findings.
• May coach, review, and/or delegate work to other team members.
• Conduct security assessments, threat modeling, and vulnerability reporting, and develop security architecture patterns for new solutions and products.
• Perform application security reviews of products and services to identify and/or validate vulnerabilities and attack chains.
• Communicate findings, attack paths, and recommendations to technical and executive stakeholders through written reports and verbal presentations.
• Develop and maintain methodologies for penetration testing.
• Assist with decision-making, prioritization, and support throughout the secure software development life cycle (s-SDLC) across a variety of security domains.
• Participate in requirements gathering, secure coding and configuration, software testing, third-party component management, and defect management.
• Serve as point of contact on secure development and security best practices.
• Consult cross-functionally to embed security gates into existing SDLC, leveraging automation when possible.
• Drive the development of standards, practices, and processes to establish, manage, and report adherence to application security requirements and best practices.
• Attend regular stand-ups and planning meetings to build positive relationships with key stakeholders.
• Serve as the security authority on assigned products, ensuring security controls are functioning, security requirements are provided before coding begins, and vulnerabilities are fixed within their SLAs.
• Ensure s-SDLC controls are embedded in assigned products and serve as control owner for a subset of these controls.
• Engage in application and domain-specific threat modeling, as well as attack surface analysis and reduction.

What you'll need

• Bachelor's degree in a related field or equivalent business experience.
• 6+ years of relevant experience.
• Experience securing enterprise-grade web applications.
• Experience with automated application security tools and technologies (SAST, DAST, SCA, etc.).
• Experience with web application security issues and standards (e.g. OWASP Top 10, SANS Top 25, etc.).
• Ability to manage projects and processes independently with limited supervision.
• Recognized subject matter expert in the applicable work area.
• Ability to situationally adapt and understand new technology and processes as per business requirements.
• Ability to identify application vulnerabilities and advise on appropriate remediation.
• Solid understanding of common languages such as .NET, Python, JavaScript, Go, etc.
• Strong foundation in core information security principles and concepts (encryption, authentication, etc.).
• Effective communication skills, with the ability to explain sophisticated security topics in simple terms to technical and non-technical stakeholders.

Details

• Location: Mumbai, India.