What are the responsibilities and job description for the Application Security Lead Engineer position at CVP?
CVP is seeking an Application Security Lead Engineer to execute and support the implementation of a successful program with specific focus on vulnerability management in an application development environment.
Responsibilities
- Analyze security needs, risks and requirements of custom systems.
- Provide solid understanding in vulnerability management and information security, including broadening awareness and use of the team services, education of security best practices and integration with other business areas.
- Provide mentorship and support to teammates regarding vulnerability assessment, communication / rapport with other divisions and various levels of leadership, technical expertise, and career development.
- Evaluate both system and application scans and architecture designs for security vulnerabilities providing remediation recommendations.
- Coordinate, build and maintain relationships with internal and external stakeholders to include system developers.
- Develop and improve KPIs, metrics, and trending for vulnerability management functions.
- Review and provide feedback on results generated by automated scanning tools.
- This shall include, but not be limited to, identification of false positives generated by those tools, either by using the data contained within the result set generated by the tools, or by manual investigation of the targets on which the testing tools identified security findings.
- Review and provide feedback on false positive, mitigation, or remediation evidence provided by IT stakeholders to determine the validity and completeness of any findings identified.
- Provide subject matter expertise concerning known vulnerabilities, and become knowledgeable of newly released vulnerabilities, and discuss methods of exploitation, methods of mitigation or remediation, severity of impact, difficulty of exploitation, and other pertinent considerations of vulnerabilities. This discussion may be required either verbally or via written presentation.
- Use prior knowledge and experience of security configurations and concepts to help create and review existing or new security policies.
- Identify the applicable NIST security controls, HHS security policy items, or security policy items that correspond to any finding identified via manual or automated testing.
- Create and conduct presentations of the security testing processes / methodologies used, as well as general security best practices, regarding security of operating systems, databases, and network fabric devices, and related technology concepts.
- Act as a liaison to external audit functions. This activity could include conducting data calls and executing ISSO-specified or approved testing activities.
- Participate in any additional activities which directly support actions required within this Task.
- Ensure all software applications are FISMA compliant.
Qualifications
Desired Skills :
Drupal
J-18808-Ljbffr
