Position Overview

• The Product Security Architect reports to the Chief Information Security Officer (CISO) and is responsible for building and executing a strategy to ensure client and consumer facing software solutions are designed and implemented to the highest security standards through a partnership with the product engineering teams

Responsibilities (Business)

• Partner with product engineering teams to develop, POC and rollout an SDLC process that embeds security into the design, development and testing processes aimed at building products with security concerns addressed in all stages

• Partner with the business to understand the needs and demands of the clients and the marketplace and develop security standards and policies to ensure products are built to meet those needs

• Work with product engineering teams to address security issues and ensure sound trade-offs

• Provide visibility around product security weaknesses to the business

• Collaborate with the application security team to design and execute a security champions program within the product engineering teams aimed at instilling security into the culture of product engineering

• Lead conversations about security with prospective & current clients alongside the business and sales team

• Develop security material (brochures, white-papers) for consumption by customers showcasing the security of our products

Responsibilities (Technical)

•Serve as the security SME for product engineering teams, Perform threat models of new products

•Work alongside technical architects to ensure secure architectural patterns are being used, Develop security requirements and stories

•Work with software engineers to design preventative and/or detective controls for specific security issues

•Work with engineering teams to build re-usable security components

•Help proliferate the use of automated security tools, that are maintained by the application security team, into the continuous integration and development environment to identify security issues quickly

•Work with members of cybersecurity operations center to integrate security monitoring of products and build use cases

•Work with members of the application security/penetration testing team to perform security testing and work with project managers to prioritize any identified issues

Qualifications

•At least 8 to 10 years systems architecture and development experience

•Experience with mobile applications, enterprise software and software as a service delivery models, cloud security

•Experience in one or more of the following modern languages/frameworks - HTML5, node.js, PHP, Java, C#...

•A strong understanding of modern development processes including agile development, lean DevOps, Microservices, continuous integration and delivery

•Solid understanding of application security topics such as authn, authz, encryption, session management, federation

•Ability to communicate complicated technical issues and risks to engineers, project managers and product managers

•Extensive experience with application security tools like code scanners, dynamic analysis tools

•Familiarity with security related certifications such as PCI, ISO27001; Expert knowledge of application security attacks