Security Engineer

The Office of Information Security is looking for people who deeply understand information security and are dissatisfied with state of the art. We are building a team of people who are pragmatic and visionary at the same time: who can take strong executive support and a strategic commitment to transformation and run with that to build something better and smarter. We are looking for those agents of change, people willing and able to leave a mark not just on a Fortune500 company, but on an entire industry.

The Security Engineer is responsible for ensuring that all IT environment and other services are free from vulnerabilities. The Engineer will work closely with other Security Operations staff, as well as Risk Management and Platform Owners in IT, to scan for, identify, assess, prioritize, and assist with the remediation of vulnerabilities within lines of codes or other services.

The Security Engineer will be able to enhance knowledge of Endpoint Security and collaborate with internal AAP team members and platform teams to apply industry best practices to AAP applications and architecture. The role will be analyzing applications from a security perspective; and examine vulnerabilities and externally reported bugs to help AAP development teams in addressing them.

A successful candidate will have experience working through ambiguity, helping to define security requirements with managers and developers, and incorporating feedback, and identifying potential problems before they become real problems.

Responsibilities include:

• Conduct security reviews with available tools to assess the security posture of applications and the hosting computer systems\u202F\\
• Execute ongoing audit reviews in assigned technical discipline in support of compliance goals and facilitate periodic audits as scheduled for regulatory compliance\
• Facilitation of remediation/mitigation efforts through peer teams as identified by internal reviews and 3rd party assessments with tracking to closure\
• Build a knowledge base of security attack vectors and common system vulnerabilities for the purposes of applying defensive controls and the development of security hardening standards\
• Document security guidelines and standards
• Build security dashboards and reporting analytics for security leadership and operations team.

Qualifications:

• Bachelors degree in Computer Science or equivalent experience
• 6+ years\u2019 experience in endpoint security, vulnerability management or similar related position.\ Retail Industry experience preferred.
• Experience with threat modelling, risk assessment and/or security testing / ethical hacking, security Architecture, etc
• Solid understanding of core technology area in either operating systems or enterprise middleware products\and expertise of network design and architecture\
• Solid knowledge and experience working with Information Security applications such as Wiz.io, Tenable(Nessus), Qualys, Rapid7, ServiceNow VR, NMap, etc.\
• Excellent technical and team skills and solid analytical skills for problem determination and resolution\
• Perform CIS benchmarking on technology where applicable\
• Excellent verbal/written communication skills and excellent interpersonal skills\
• Any industry recognized security certification is preferred (CISSP, CEH, OSCP etc)

• Strong communication and collaboration skills and experience interacting at all levels throughout IT/business teams and working within large, matrixed organizations
• Able to work independently with strong critical thinking, decision making, troubleshooting and problem-solving skills