Principal Application Security Engineer

View full description

Requirements:

• Bachelor’s or Master’s degree in Computer Science, Information Security, or a related field.
• Minimum of 10 years of experience in application security engineering.
• Proven experience in achieving security certifications such as SOC2, FEDRAMP, GDPR.
• Deep understanding of AWS services and security best practices.
• Strong knowledge of security principles, practices, and technologies related to AWS and Kubernetes.
• In-depth understanding of web, API, and microservices security.
• Expertise in cloud infrastructure security, especially AWS services like IAM, EC2, S3, and Lambda.
• Solid grasp of common security vulnerabilities and mitigation techniques, especially in containerized environments.
• Familiarity with DevSecOps practices and CI/CD pipelines.
• Hands-on experience with security tools such as SAST/DAST, vulnerability scanners, and penetration testing frameworks.
• Proficient in security assessment tools and methodologies.
• Strong knowledge of compliance frameworks and standards.
• Familiarity with programming languages such as Python, Go, or Java.

Responsibilities:

• Develop and implement a comprehensive application security strategy aligned with company objectives.
• Lead initiatives to achieve security certifications, including SOC 2, FEDRAMP, GDPR compliance.
• Collaborate with cross-functional teams to integrate security best practices into all stages of the Software Development Lifecycle (SDLC).
• Assess and enhance the security of applications hosted in AWS and Kubernetes environments.
• Conduct regular security assessments, code reviews, and vulnerability scans.
• Implement security controls and policies to protect against threats and vulnerabilities.
• Prepare and lead efforts to achieve SOC 2 certification and maintain compliance.
• Coordinate with external auditors and ensure all security documentation is up-to-date.
• Plan and oversee regular penetration testing activities and analyze test results.
• Provide training and mentorship on secure coding practices.