Lead InfoSec Engineer

Job Summary

We are looking for an Application Security Engineer to strengthen the security of Synamedia products and the software development lifecycle. The role partners with engineering, architecture, DevOps, cloud and security teams to identify risks early, automate security controls, and help teams build secure products at scale. The ideal candidate combines hands-on AppSec skills with strong software engineering awareness and can translate security findings into practical remediation guidance.

Responsibilities

• Perform security assessments of web applications, APIs, microservices and cloud-native applications.
• Conduct threat modelling and security design reviews for new products, features and architectural changes.
• Perform secure code reviews and identify vulnerabilities, insecure coding patterns and design weaknesses.
• Implement and improve SAST, DAST, SCA, secrets scanning and related AppSec tooling.
• Integrate automated security checks and risk-based quality gates into CI/CD pipelines.
• Validate, triage and prioritize vulnerabilities based on exploitability, technical impact and business risk.
• Work with engineering teams to provide actionable remediation guidance and track vulnerabilities through closure.
• Assess authentication, authorization, session management, cryptography, data protection and input-validation controls.
• Perform security testing of REST APIs and service interfaces, including authorization, injection, data exposure and business-logic issues.
• Develop security automation and scripts to improve the scalability and effectiveness of the AppSec program.
• Define secure coding guidance, security checklists and developer enablement material.
• Contribute to application-security metrics, reporting and continuous improvement of the Secure SDLC.

Skills Required

• 7+ years of relevant experience in Application Security, Product Security, DevSecOps, penetration testing or secure software development.
• Strong understanding of OWASP Top 10, OWASP API Security Top 10, CWE/common vulnerability classes and secure coding principles.
• Hands-on experience with SAST, DAST, Software Composition Analysis (SCA), secrets scanning and web/API security testing tools such as Burp Suite or OWASP ZAP.
• Experience conducting threat modelling using STRIDE or a comparable methodology.
• Ability to review source code from a security perspective in one or more languages such as Java, C/C++, C#, Python, JavaScript/TypeScript or Go.
• Understanding of CI/CD technologies such as Jenkins, GitHub Actions, along with Git-based development workflows.
• Ability to clearly communicate vulnerability impact, exploit scenarios, remediation options and risk to engineering stakeholders.
• Experience with AWS, Azure or GCP; Docker, Kubernetes and Infrastructure-as-Code security.
• Experience with tools such as Black Duck, Coverity, Trivy, and TruffleHog.
• Familiarity with OAuth 2.0, OpenID Connect, SAML, JWT, RBAC and modern identity/security patterns.
• Exposure to software supply-chain security, SBOM, dependency governance and secrets management.
• Security certifications such as CSSLP, CISSP, CCSP are advantageous but not mandatory.

Good to Have - Synamedia Product Video Domain

• Experience or domain knowledge in video streaming, broadcast, OTT, Pay-TV or media technology environments.
• Exposure to solutions similar to Synamedia Go, Synamedia Iris, Conditional Access, DRM and video/content security platforms.
• Understanding of Conditional Access systems, DRM, entitlement management, content protection, anti-piracy and secure video delivery.
• Familiarity with OTT/video technologies and protocols such as HLS, MPEG-DASH.

Disclaimer: This job posting has been aggregated from external source. Role details, content, and availability are subject to change. Applicants are advised to confirm the latest information directly on the company website before applying.