Principal Information Security Engineer

Responsibilities

• Design, operate, and continuously improve application security testing capabilities and pipelines.
• Assess application risks and recommend mitigations using consistent risk management practices.
• Perform application-layer security reviews of code across multiple languages and frameworks.
• Assist with application-layer penetration testing and vulnerability identification.
• Provide application security guidance and mentorship to development teams.
• Develop automations and applications using Python, TypeScript, Java, or PowerShell.
• Create and maintain reusable GitHub Actions workflows and manage GitHub workflows.
• Collaborate with development, DevSecOps, and information security teams on secure application design and vulnerability remediation.

Requirements

• 8+ years of application security experience, including manual and automated code reviews, manual penetration testing, dynamic application security testing, and false-positive analysis.
• Experience determining risk from security findings using a consistent risk management framework.
• Proven ability to develop automations or applications using Python, TypeScript, Java, or PowerShell.
• Experience creating and maintaining reusable GitHub Actions workflows.
• Hands-on experience in a Kubernetes-based DevSecOps environment and knowledge of Kubernetes security best practices.
• Ability to read and analyze code for security and design vulnerabilities.
• Understanding of OAuth, OIDC, REST, and other common web application security standards.
• Experience with AWS and Azure.
• Bachelor’s degree in computer science or a related field.
• US citizenship and willingness and ability to maintain a US Security Clearance.
• Preferred proficiency in C#, Python, Bash/Shell, PowerShell, JavaScript, SQL, or Java.
• Preferred familiarity with GitHub Copilot, AI-assisted coding practices, and the security risks of AI-generated code.
• Preferred experience interpreting application penetration testing, code scanning, and open-source scanner findings.
• Preferred understanding of layer 2–7 communication protocols, encoding, encryption schemes, and algorithms.

Benefits

• Medical, dental, vision, basic and supplemental life insurance for employees and families.
• 401(k) and profit-sharing programs.
• At least 80 hours of accrued vacation leave.
• Twelve paid holidays per calendar year.
• Opportunities for personal and professional growth.