Security Lead

Location: Santa Clara, CA or Phoenix, AZ (Hybrid) Duration: Contract to hire

Qualifications

• MS in CS/EC/EE
• 8+ years of professional software design and development experience
• A proven record of delivering in Security Engineering, 5+ years of experience in product security.
• In-depth knowledge of common application & network protocols, cryptographic technologies, public key infrastructure
• Effective written and oral communication with multiple levels of leadership involving both the business and technical
• Sophisticated knowledge of security and compliance frameworks (MITRE ATTACK, NIST 800-53, FedRAMP, ISO 27001, CUI, GDPR, CSA, SOCs and SOC3)
• Knowledge of cloud platforms (e.g., AWS, GCP, Microsoft Azure), and are enthusiastic in contributing to or public writings about cloud-computing, containers, platform security
• Must be able to work independently in a dynamic environment with globally distributed team members
• Experience in security audits, risk, and compliance
• Have worked on Security tooling and best practices, such as pre-commit hooks, SW dependency scanning, SAST, IAST, OSS, DAST, RASP, and vulnerability management, etc
• Deep understanding of information security-related topics, such as authentication, identity management, data protection, data leakage prevention, validation checking, encryption, key management, principle of least privilege, software attack methodologies, securing data in transit, at rest, and so forth is expected

Responsibilities

• Coordinate security assessments and penetration testing activities between third-party vendors, engineering teams, security operations, and other stakeholders
• Help build positive relationships with Engineering, Enterprise Security, and customer-facing teams as a core tenant of the role and the team.
• Will be both hands-on and influential, expected to directly communicate with cross-functional teams in Product Management, Development, and DevOps/SRE to drive security throughout the entire product.
• Ensure the adoption of SDLC and security best practices across the entire application lifecycle, to shift left the security aspect in SDLC.
• Inform choices through a security lens for the entire development lifecycle, including design, coding & development, QA & security testing and release.
• Drive effective integration and adoption of best practices, latest methods & techniques in identifying design flaws and software issues
• Ability to ascertain and clearly articulate the size and scope of an assessment, articulate, assess product security risks and maintain risk register