Cyber Security Engineer -- Threat Modeling

Please find details for this position below:

Client: Banking/Financial Industry

Title: Cyber Security Engineer -- Threat Modeling / Threat Modeling Engineer

Location: Charlotte, NC - Remote

Duration: 12 months, convert to hire - No C2C

Critical Screening Questions and Answers: (Used by Supplier to Get Best Fit. Suppliers will provide the candidate answers to these questions as part of resume submittal to VMS)

• Which threat modeling tools have you used?
• At a high level, walk through threat modeling a customer-facing banking web site?
• How do you identify and validate trust boundaries, assets, and assumptions when documentation is incomplete?
• How do you distinguish between a plausible threat scenario and a potential threat to a development team?

Description :

Business Initiative/Purpose: (Goal, Business Impact, Accomplishments from the work)

• Threat Modeling BAU tasks.
• Mature Threat Modeling practice.
• Help with pen testing as time permits.

Bachelor Degree: (Required, Preferred or Not Required)

• Preferred.

Role Responsibilities: (what they will be doing)

• Perform threat modeling using a TM tool, work with app teams to answer questions about their system's architecture, and provide prioritized mitigation strategies for threats and attack paths.
• During periods of lower threat modeling demand, support penetration testing program coordination activities.

Must Have Skills/Prior Experiences: (Vendor should not submit any candidate that does not have these skills/prior experience.)

• Prior threat modeling and/or architecture experience.
• Comfortable with PASTA and STRIDE+P methodologies.
• Familiarity with MITRE ATT&CK.
• Able to work with app teams to explain threat modeling and its output.

Plus/Nice to Have Skills/Prior Experiences:(Hiring Manager DOES NOT require these skills/ prior experience. However candidates with any of these will be looked at first.)

• Bank/regulated background.
• Threat model program build-out.
• Experience supporting security, risk, compliance, or audit activities.
• Experience supporting vulnerability remediation activities, preferably for penetration testing.
• Working knowledge of common application security vulnerabilities and remediation approaches.
• General understanding of application architectures and technologies.
• Project management.

EEO:

Mindlance is an Equal Opportunity Employer and does not discriminate in employment on the basis of – Minority/Gender/Disability/Religion/LGBTQI/Age/Veterans.