Introduction
The IBM Fusion team part of IBM Storage is looking for a talented, innovative and enthusiastic Software engineering professional for Security Squad. We are a global team, so communication skills (both verbal and written) are critical as well as flexibility to work with team members in other time zones.
Your Role And Responsibilities
The Product Security Lead is responsible for defining, implementing, and maintaining the overall security posture of the product throughout its lifecycle. This role works closely with engineering, QA, and stakeholders to ensure secure product releases and compliance with relevant security standards.Key ResponsibilitiesOwn and continuously improve the overall security posture of the product.Analyze, prioritize, and manage vulnerabilities (CVEs) and clearly communicate reproduction steps, impact, and remediation guidance to development teams.Review and assess security findings from multiple sources, including SAST, DAST, container/image scans, and penetration testing.Partner with development teams to ensure vulnerabilities are fixed effectively and within defined timelines.Lead all security activities required for product release readiness, including risk assessments and security sign-offs.Act as a subject matter expert to address customer security questions, audits, and security reviews.Ensure compliance with applicable regulatory and security standards such as FIPS, DORA, and other customer-specific or regional requirements.Drive continuous improvement in secure development practices and security processes.
Required Technical And Professional Expertise
- Software Development Expertise: Experience with designing, developing, testing, and delivering software solutions using leading-edge and/or proven technologies.
- Agile Development Methodologies: Experience working in an Agile, collaborative environment to understand stakeholder requirements and deliver high-quality software solutions.
- Component-Level Design: Experience with designing, coding, and testing innovative component-level software solutions, ensuring unit testing and integration readiness.
- CI/CD Pipeline Development: Experience contributing to automated CI/CD pipelines, ensuring seamless integration and delivery of software solutions.
- Debugging and Problem-Solving: Experience with designing, developing, and unit testing code fixes for complex software problems, collaborating with stakeholders to resolve issues efficiently.
Preferred Technical And Professional Experience
Hands on experience with Kubernetes/openshift, containers, python.Hand on experience with different scanning tools like ZAP, twistlock etcGood understanding of tools used in DevSecOpsGood understaing of cloud, container, must have knowldege of container and web secuirtyMust have fair understanding of penetration test, starting from defining scope, discussion with pentest team, understand reported vulnerabilities and explain to developers to fix it...in some cases, it able to reproduce the issue.
