What are the responsibilities and job description for the Cyber Security Engineer position at eRichards Consulting?
Our excellent client seeks a SR Enterprise Cyber Security Engineer for a 6-month HYBRID W2 contract in either NY, Boston, or Springfield.
Responsibilities:
- Embed security best practices into the software development lifecycle (SDLC).
- Conduct in-depth security assessments, including vulnerability scanning, and code reviews.
- Leverage automated tools and manual testing techniques to identify, risk assess and prioritize and propose mitigation strategies for identified threats and application-level vulnerabilities (e.g., OWASP Top 10, etc.) ensuring applications meet security standards and reducing exposure to data breaches.
- Collaborate with security architects to design secure application architectures.
- Ensure secure coding practices are followed, and security controls are incorporated into software designs.
- Conduct detailed threat modeling to identify attack vectors and potential weaknesses.
- Collaborate with our SDLC Council to develop and maintain secure coding standards, empowering developers to integrate security into the development process.
- Partner with DevOps teams to implement security within CI/CD (continuous integration & delivery) pipelines for automated and seamless deployment of secure code.
- Develop, configure, maintain tools for static and dynamic application security testing (SAST/DAST).
- Evaluate third-party software and APIs for security compliance.
- Assist in incident response activities related to application security breaches, providing rapid identification and mitigation guidance.
- Ensure compliance with security regulations, frameworks, and industry standards such as OWASP.
- Leverage reporting tools to demonstrate the overall risk through metrics (KPIs, KRIs, OKRs) of vulnerabilities and code defects to cyber assets for various team leaders and executive leadership for risk prioritization and enablement of risk-based decision-making.
- Current with the latest security threats, vulnerabilities, and industry trends to inform and improve security strategies.
- Educate developers and stakeholders on secure coding practices.
- Ability to explain security issues to both technical and non-technical stakeholders.
Skills: Qualifications:
- Bachelor's or master's degree in computer science, Information Security, or a related field.
- 8 years of experience in application security, penetration testing, or secure software development.
- Relevant security certifications such as CEH, OSCP, CISSP, or GWAPT from an industry recognized certifier (e.g., SANS/GIAC, CompTIA, ISACA, ISC2, etc.)
- Strong knowledge of secure software development methodologies, including threat modeling, code reviews, and static/dynamic analysis.
- Knowledge of application security vulnerabilities and best practices (e.g., OWASP Top 10, etc.
- Experience in integrating security into DevOps (DevSecOps) and CI/CD environments.
- Technical knowledge of web application security, cloud security (AWS, Azure, GCP), mobile security, infrastructure as code (IaC), containerized environments (Docker, Kubernetes).
- Hands-on experience with security tools such as SAST, DAST, SCA, IAST, and fuzzing tools.
- Advance understanding and experience with writing source code in at least one programming language (e.g., JavaScript, Java, C/C /C#, Python, etc.) and familiarity with software security frameworks (e.g., Maven, Node, Gradle, etc.).
- Experience with identifying security vulnerabilities/defects in dockers, containers, and Kubernetes.
- Experience with cloud deployment and automation tools (Terraform, GitHub Actions, Jenkins, AWS Cloud Formation Templates, Secrets Managers).
C JAVA MAVENCLOUD SECURITY SCANNING
