We are looking for a highly motivated Senior Software Engineer, Security Engineering to join our security team. This role will primarily focus on remediating security vulnerabilities, with a specific emphasis on remediating dependency vulnerabilities from various sources supported by in-house automations. The ideal candidate will ensure issues are accurately identified, prioritized, and communicated for remediation, and will also contribute to building and maintaining a centralized CI pipeline that ensures the quality of the fixes. You will play a key role in maintaining our security posture.
Responsibilities:
- Build security automations for internal use that enables Security Engineering to operate at high speed and wide scale.
- Triaging vulnerabilities identified from different sources such as application security reviews, Pentest, SAST, DAST, and SCA, with a strong focus on validating and remediating open-source dependency vulnerabilities.
- Execute the end-to-end dependency remediation process, including:
- Analyzing and validating findings from SCA tools like Snyk
- Creating and managing Pull Requests (PRs) for dependency upgrades/patches.
- Testing and verifying that the upgraded dependencies resolve the vulnerability without introducing regressions.
- Automate the process described above as much as possible.
- Drive the prioritization and remediation plan for vulnerabilities in partnership with engineering teams.
- Contribute to the design and implementation of centralized CI pipelines to embed security throughout the development lifecycle.
- Provide support in grooming vulnerability backlog and vulnerability metrics reporting.
Our Ideal Candidate Will Have:
- Good understanding of Web application security, identification, and remediation of code and design flaws.
- Experience in Building security tooling and automation scripts. Must be very hands on.
- Good development experience in at least one of the following: Go and/or Python.
- Strong practical experience in remediating third-party and open-source dependency vulnerabilities.
- Proficiency with Software Composition Analysis (SCA) tools like Snyk and socket.dev.
- Solid experience with Git, GitHub, and the Git CLI for source code management, branching, merging, and PR workflows.
- Experience in building or maintaining centralized CI/CD pipelines (e.g., using GitHub Actions, Jenkins, GitLab CI, etc.).
- Good understanding of OWASP Top 10 vulnerabilities.
- Good Experience in enterprise vulnerability management.
- Experience in source code review.
- Experience with security tools (SCA, SAST, DAST, Burp Proxy, ZAP Proxy etc.)
- Ability to explain complex security issues and their impact to diverse audiences.
- Familiarity with cloud platforms (AWS, Azure) and their security features.
- Experience with Agile software development practices. Knowledge of Scrum and Kanban is beneficial. Understanding of Agile estimation and iterative processes.
Also Nice to Have:
- Hands-on experience with Kubernetes and container security principles.
- Experience specifically securing workloads within the AWS ecosystem.
- Experience with OWASP Top 10 security vulnerabilities.
- Any cloud infrastructure automation skills (Terraform).
- Experience with Agile software development practices. Knowledge of Scrum and Kanban is beneficial. Understanding of Agile estimation and iterative processes