Senior Software Engineer II

The Security Architect Associate (SAA) role supports the Security Engagement (SER) process, which is a function of the Security Architecture and Strategy team. The SAA is part of the team who engage with our fellow associates to gather information needed for the Security Architecture and Strategy team to perform an assessment of the security posture for proposed or existing applications and systems in the environment. The role ensures company security policies, standards and industry standards are communicated to program teams during the Software Development Life Cycle (SDLC) process and gathers information and evidence in support of that. The SAA is able to identify gaps and work with project teams to improve security while retaining time to market, functionality and scalability. The candidate for this role supports SERs by assuring the information and evidence needed is gathered and validated,

Measures of success (examples): SERs are progressed from intake to decision with predictable turnaround aligned to published SLAs/targets; submissions are complete and accurate (minimal rework due to missing/incorrect information); stakeholders receive timely updates and clear action items, so remediation and approval decisions are not delayed.

Requirements:

• Bachelor's degree in computer science, information systems, cybersecurity or a related field or equivalent experience/certification.
• 5+ years of overall Information Technology experience.
• 3+ years of Information Security experience in security engineering with experience in two or more of the following areas.
• Conducting security reviews and identifying risks and gaps.
• Performing security accreditations.
• Developing security architectures and strategies.
• Working with development teams and vendor teams to implement compensating controls.
• Experience in reviewing and identifying security risks/gaps as well as mitigation strategies.
• The SAA should have 3+ years combined experience in two or more of the following areas: Full-stack knowledge of IT infrastructure: Applications, Databases, Operating systems Windows, Linux, and UNIX, IP networks WAN and LAN, Backup networks and media, Containers/Kubernetes and microservices, Cryptography and current cryptographic standards, including PKI.
• Direct, hands-on experience or a strong working knowledge of vulnerability management tools.
• Working knowledge of the OWASP Top 10 (current edition).

Preferred:

• Strong working knowledge of IT service management (e. g., ITIL-related disciplines): Change management, Configuration management, Asset management, Incident management, Problem management.
• Ability to provide and interpret Security Requirements for areas including but not limited to: Cloud Computing, Application Development, IAM, Cryptography, and Infrastructure design and standards.
• Familiarity with AI terminology and infrastructure principles, along with security topics and concerns impacting AI.
• Ability to understand large, complex integrated solutions and provide the security needed between systems.
• Experience designing the deployment of applications and infrastructure into internal, hybrid, and public cloud services.
• Ability to conduct independent research.
• Strong abilities and experience in documentation and written communication for diverse audiences.
• Experience working with diverse and distributed global teams.
• Current information security certification(s), such as Certified Information Systems Security Professional (CISSP), Certified Information Security Manager (CISM), ISC2 Certified Cloud Security Professional (CCSP), GIAC certifications, ITIL.
• Knowledge of Industry Standards such as NIST Cybersecurity Framework (CSF), PCI-DSS, COBIT, CSA, MITRE ATT& CK and CAPEC, STRIDE, NIST 800-53 SOX, CIS Benchmarks, etc.
• Knowledge of securing technologies such as, but not limited to: SaaS services (i. e., Microsoft 365 Salesforce), Application Design, Container Platforms (i. e., Docker, Kubernetes), APIs, Serverless, Network Infrastructure, Operating Systems, Identity and Access Management.
• Knowledge of SDLC (Waterfall/Agile), DevSecOps, and good understanding of the ITIL Framework.
• Knowledge of SAFe Agile Methodologies, experience with customer ticketing systems to manage engagements.
• Strong negotiating, influencing and problem resolution skills.
• Ability to effectively prioritise and execute tasks in a high-pressure environment.
• Ability to assess customer/client needs, creatively approach solutions, decide and influence appropriate courses of action.
• Graduate degree in Computer Science or Engineering.

Managing Projects and Priorities:

• Develops specific goals and plans to prioritise, organise, and accomplish work.
• Champions leaders' vision for product and service delivery.
• Makes and executes the necessary decisions to keep moving forward toward achievement of goals.
• Provides direction and assistance to other teams regarding projects.
• Determines priorities, schedules, plans and necessary resources to promote completion of any projects on schedule.
• Analyses information and evaluates results to choose the best solution and solve problems.
• Generates and provides accurate and timely results in the form of reports, presentations, etc.

Delivering on the Needs of Key Stakeholders:

• Understands and meets the needs of key stakeholders.
• Communicates concepts clearly and persuasively that is easy to understand.
• Demonstrates an understanding of business priorities.

Providing Technical Support and Consultation:

• Provides technical expertise and technical leadership within their own team and other teams.
• Applies knowledge/judgment to achieve business goals.
• Foresees, identifies, and resolves problems.
• Keeps up-to-date technically and applies new knowledge to the job.
• Performs other reasonable duties as required for this position.