Sr. Security Engineer

Overview

Senior Security Engineer on the F5 Security Incident Response Team (F5 SIRT), a dedicated global team that manages the receipt, investigation, and public reporting of security vulnerability information related to F5 products and networks. The role provides expert security technical leadership for the team.

What you'll do

• Manage multiple security issues of diverse scope simultaneously and prioritize them based on customer and business needs, without direction.
• Provide F5 customers with a consistently high-quality support experience, including clear written communication, and own issues until resolution or return to business as usual.
• Participate in weekend support rotation and in tier 2 and tier 3 security support.
• Perform incident handling and drive attack analysis and mitigation options, including expert attack analysis, configuration suggestions, and potential onsite interaction.
• Follow incident handling procedures, maintain incident documentation, participate in post-mortems, and write incident reports.
• Monitor and identify security vulnerabilities in F5 products and services through internal reports, external researcher submissions, bug bounty programs, and industry threat intelligence; triage and assess severity, impact, and prioritization.
• Coordinate with Product Engineering, Product Management, Legal, Corporate Communications and other teams to develop and disseminate security advisories, mitigations, and fix notifications to customers, partners, and the public.
• Manage interactions with external security researchers, validating vulnerability disclosures and facilitating recognition or rewards through bug bounty programs.
• Develop, maintain, and update security and Quarterly Security Notification (QSN) playbooks and workflows.
• Research emerging threats and mitigation options, and develop and deliver security content and training, including workshops in a lab environment and security presentations for a wide audience.
• Mentor and train other security engineers and F5 SIRT specialists, identify team knowledge and technical skill gaps, and lead projects providing guidance to less experienced staff.
• Perform expert threat and vulnerability management, including monitoring of CVE and vendor notifications, and lead steering committees to analyze vulnerabilities and assess risk ratings.
• Evaluate and execute cross-functional security initiatives and work with Engineering teams to ensure systems are remediated according to policy and standards.
• Provide strategic security analytics metrics and reports, including executive-level dashboards, and communicate risks and urgency to management and engineering staff.
• Ensure security-related knowledge is documented within KCS and represent Security within the KCS Evolve Loop.
• Engage with the broader security community, including industry forums and PSIRTs (e.g. CISA, FIRST, VINCE).
• Uphold F5's business code of ethics and promptly report violations of the code or other company policies.

What you'll need

• Minimum of 15 years of experience in a technical security role such as support, monitoring or consulting (e.g. pen testing) working with relevant technologies.
• BA/BS degree or equivalent experience.
• Information security subject matter expert with expert understanding of industry standards such as CVE, CPE, and CVSS, and a strong understanding of security frameworks and NIST standards.
• Appropriate security-based qualification: CISSP, GCIH (or demonstrated skills and ability to obtain certification).
• Public cloud certifications (or demonstrated skills and ability to obtain certification).
• Expert experience with security incident handling processes, procedures and methodologies, including working security incidents in corporate production environments.
• Expert technical experience identifying and mitigating a breadth of attacks such as DDoS, web application, DNS, and other network attacks.
• Expert knowledge of common security vulnerabilities and ability to judge their severity.
• Experience with network and packet analysis tools and network vulnerability scanners.
• Expert knowledge of Web Application Firewalls, Firewalls and IPS/IDS.
• Expert OS hardening and security best practices.
• Knowledge of common malware types and infection vectors.
• Expert knowledge in threat modeling, secure architecture, secure coding practices, and security testing.
• Hands-on technical experience with and knowledge of LAN/WAN operations and/or networking hardware.
• CVE and CERT experience.
• Expert knowledge of security offensive/defensive techniques and methodologies, and of TCP/IP, SSL, DNS, HTTP and common protocols.
• Coding experience with proficiency in Python and knowledge of other scripting languages.
• Understanding of the underlying mechanisms of security vulnerabilities at code and assembly level (e.g. buffer overflows, input sanitisation).
• Knowledge of network and security monitoring tools, load balancers, WAFs and common network architectures.
• Working knowledge of standard UNIX/Linux command line tools.
• Hands-on experience with public clouds (e.g. AWS, Azure, or GCP) and container-based deployments and orchestration tools (e.g. Kubernetes, Docker, Terraform, Ansible).
• Knowledge of microservice architecture, modern application architecture, and API security.
• Ability to create attack Proof of Concepts and generate new training and knowledge sharing content.
• Ability to relay technical information to customers with varying skill levels.
• Must be able to read, write, and speak English fluently, including technical concepts and terminology.
• Analytical thinker with strong attention to detail, proven track record in a team environment, and able to work with moderate supervision.

Nice to have

• More than one security certification (CISSP, GCIH).
• Experience with incident tracking software; Seibel experience.

Details

• Location: Hyderabad (SEZ).
• The role is regional, covering Americas, EMEA and APJ.
• May require work outside core business hours, including early morning, late evening, overnight, weekends and/or holidays.
• Requires participation in an on-call rotation.
• Some travel required (approximately 20% of time); a current passport is required.
• Some datacenter/lab work; may require ability to lift 50 lbs to rack controllers at customer locations or in the lab.