Principal Product Security Engineer, DevSecOps

Key Responsibilities: 

• Accountable for the design, implementation, and maintenance of security measures across the product lifecycle, with a focus on DevSecOps and "shift left" practices. 

• Drive the unified security testing roadmap from strategy to execution 

• Develop and deploy CICD security integrations for code, dependency, container, secrets, and IAC security. 

• Utilize data analytics to identify and mitigate security vulnerabilities. 

• Implement and manage security tools/integrations such as GitHub Advanced Security, Wiz, and Veracode. 

• Serve as a trusted advisor, working with cross-functional teams to ensure security is integrated into all stages of development. 

• Provide mentorship and guidance to junior engineers and other team members on security best practices. 

• Stay up-to-date with the latest industry trends and advancements in security technologies and practices.  

• Develop and maintain documentation related to security policies, procedures, and guidelines. 

Qualifications: 

• Education: 

• Bachelor's or Master’s degree in Computer Science, Information Security, or a related field. 

• Experience: 

• 10+ years of experience in software engineering, with a strong focus on security.  

• Technical Skills: 

• Proven experience in deploying applications and integrating APIs at scale. 

• Extensive knowledge of DevSecOps practices and "shift left" security principles.  

• Strong skills in development/scripting and automation 

• Proficiency in data analytics and the ability to leverage data to enhance security.  

• Familiarity with security tools such as GitHub Advanced Security, Wiz, and Veracode.  

• Strong ability to operate independently and autonomously, with excellent problem-solving skills.  

• Soft Skills: 

• Excellent communication and collaboration skills, with the ability to work effectively with cross-functional teams. 

Additional Knowledge & Critical Skills: 

• Self-motivated 

• Critical Thinking 

• Intellectual Curiosity 

• Accountable 

• Drives results 

• Team player 

Additional Knowledge & Skills (Optional): 

• Knowledge of healthcare, privacy, and financial compliance regulations 

• Strong analytical and troubleshooting skills with an understanding of IT business operations and information security 

• Familiarity with industry security frameworks and standards such as NIST, CIS Controls, and OWASP 

• Experience in applying cryptographic techniques to protect data at rest and in transit, and ensuring secure communications