Our direct end client is working in a Hybrid model (3 days in office-2 days remote)
They are seeking Candidates with experience in Verifying and Developing Standards for the App Dev teams to build Secure Apps.
Key duties will be the assessment of the security of applications — commercial products and inhouse developed — throughout their lifecycle, at the stages of requirements gathering, design, build, procurement and update, to ensure compliance, while enabling the business to meet the requirements of the information security technology architecture, strategy and baseline.
*They will work with several App Dev and Product teams across various Time zones (Remote teams and local in Jersey City)
Experience of web server, web application and API security and remediation. In-depth knowledge of OWASP Top-10 security risks and how to address them
Experience of application risk assessment via threat modelling using STRIDE, OCTAVE, PASTA or similar framework, and of providing recommendations to mitigate threats and reduce risk
Working knowledge of multi-factor authentication and single sign-on mechanisms for applications.
§ Working knowledge of Amazon Web Services and Microsoft Azure cloud computing platforms.
§ Good general knowledge of core security networking concepts like TLS, SSH, DNS, firewalls.
§ Good general knowledge of enterprise software, containers, operating systems and server virtualization.
§ Experience of conducting product evaluations, proofs of concept, pilots and rollouts.
§ A proven ability to interface across a global organization with other teams, such as EIS Engineering and Security, Corporate Applications, Enterprise Applications, Internal Audit, agency CIOs, and agency security teams and compliance coordinators, etc.
§ An analytical demeanor and the ability to effectively communicate with individuals across all levels the organization.
§ Excellent written and verbal communications skills.
§ Ability to adjust to changing priorities while multitasking effectively.
§ Working knowledge of compliance frameworks and security management standards (e.g., ISO 27001, COBIT, NIST CSF, PCI-DSS, ).
§ Working knowledge of best practices/standards (e.g., PCI DSS, HIPAA, State data breach laws) for implementing application-level data encryption.
§ Bachelor’s degree in Computer Science, Information Security and Risk Management, Information Systems, Engineering or related major.
§ CISSP, CASE, CASS, CLSSP, GIAC GWEB similar certification required.
§ Solid progressive experience working in Information Technology with at least some of that directly in Information Security.
§ Some experience in a security architect role with experience in reviewing and approving the security of applications.