- Day-to-day
- Implement security policies in CI/CD tools like SAST and SCA, define code-level security rules for multiple languages, work with development teams on DevSecOps processes, manage GitHub repository security measures
- You'll bring
- 5 years Python development, 5 years Linux with strong bash scripting, CI/CD pipeline knowledge, APIs and unit testing frameworks experience, bachelor's degree or 10 years IT work experience
- Good fit if
- SAST/OSS technology knowledge, Python code review ability, monitoring and data analysis expertise, Jenkins/GitHub Actions experience, Kubernetes/Docker familiarity, security tool integration experience
Department: Cloud Security & Developer Enablement, CDRR
Role: Application Security Engineer
ALPHARETTA OR NYC (2 roles)
About Us:
Client is a leading global financial services firm providing a wide range of investment banking, securities, investment management and wealth management services. We advise, originate, trade, manage and distribute capital for governments, institutions and individuals. As a market leader, the talent and passion of our people is critical to our success. Together, we share a common set of values rooted in integrity, excellence and strong team ethic. We provide you a superior foundation for building a professional career where you can learn, achieve and grow. At Client, we embrace integrity, excellence, teamwork and giving back. As a market leader, the talent and passion of our people is critical to our success. The people of Client provide our clients with the finest thinking, products and services to help them achieve even the most challenging goals.
About the Team:
The mission of the Cloud Security & Developer Enablement team is to implement the Firm's Cybersecurity Strategy by architecting, engineering, deploying and operating technical security controls and capabilities for the Enterprise. This is achieved by continued focus on architectural rigor, automation, agile delivery and adoption of Cloud and application security control implementations by development community.
What You ll Do:
Be part of a team of engineers to implement Client specific security policies in the CI/CD security tools including but not limited to SAST, OSS and SCA applications.
Work with Development, DevOps and Security teams to identify and develop automated security and compliance capabilities in support of DevSecOps processes.
Define the security rules that needs to be adhered to at a code level in web and mobile applications written in .NET, Java, React, Python and other languages.
With your development background and security knowledge, provide secure stable platform for enforcing application security controls.
Support security standards, design & implement architectural patterns to increase the resiliency and scalability of security platform.
Work with our partners to implement, manage, and optimize security measures within our GitHub repositories to continuously improve code integrity and protect against vulnerabilities.
Required skillset:
Must have: 5 years software development experience using Python
Working with APIs, including but not limited to ReST
Unit testing frameworks
Multi-process and multi-thread architecture
Must have: 5 years in linux, strong bash scripting skills.
Deep understanding of CI CD pipelines
Working knowledge of windows environment, simple scripting dos-batch etc.
Bachelor s degree with 10 years of work experience in the IT field
Ability to process large datasets for reporting and analysis.
Desired Skillset:
A self-starter, with a strong desire for learning new technologies and applying them to solve problems
Knowledge of SAST, OSS technologies
Ability to perform Python code reviews with minimal assistance
Expertise in monitoring, alerting, reporting, data analysis is desired.
Experience with application build environments like Jenkins, GitHub Actions, Teamcity etc.
DevOps container/orchestration tools (Kubernetes, Docker, Puppet, etc) is a plus
Experience with evaluation, integration and onboard of security tools such as DAST, RASP, WAF, vulnerability scanner results, container analyzers, open source scanning is a plus