EdgeVerve - Lead/Manager - Product Security (6-15 yrs)

Job Objective

As a Product Security Engineer specializing in the financial domain, you will play a vital role in ensuring the security of our cloud-native products. You will be responsible for overseeing vulnerability assessments, penetration testing, and contributing to a secure development lifecycle (SDL) to safeguard our financial products from emerging threats.

Key Responsibilities :

- Conduct comprehensive vulnerability assessments and penetration testing on critical financial web applications.

- Leverage SAST and DAST tools to identify and analyze security vulnerabilities, recommending effective remediation strategies.

- Perform security assessments of web services and APIs, focusing on identity and token authentication and authorization mechanisms.

- Design and implement secure software systems, ensuring that security is an integral part of the software design process.

- Collaborate with the development team to apply secure design principles and patterns.

- Identify potential security vulnerabilities during the design phase and propose secure solutions.

- Analyze and assess cryptography implementations, key management practices, and rotation procedures.

- Deep dive into existing codebases to thoroughly assess security posture and identify potential vulnerabilities.

- Collaborate with development teams to implement secure architecture and design principles throughout the SDL.

- Maintain up-to-date knowledge of emerging threats like DDoS, ransomware, supply chain attacks, and implement countermeasures to mitigate risks.

- Stay abreast of industry best practices, including OWASP Top 10, SANS Top 25, BDH, and Palo Alto advisories.

- Ensure adherence to proper security postures and standard processes for both public and private cloud deployments.

Qualification :

- 10 -15 years of experience in production/cloud security, with a focus on the financial domain and product security.

- Thorough understanding of HTTPS, TLS 1.2, TLS 1.3, and public/symmetric key cryptography.

- Proven experience in software design, with a focus on integrating security into the design process.

- Experience with one or more of the following :

1. Front-end technologies such as Angular, React, or JavaScript.

2. Back-end technologies such as Java, Node.js, TypeScript, Spring, or C.

- Strong understanding of secure design principles and patterns.

- Experience identifying and addressing security vulnerabilities during the design phase.

- Familiarity with security tools and screening/reporting experience is a plus, but the primary focus should be on software design experience.

- Proficiency in security tools like Burp Suite, Nmap, ZAP, Black duck Hub, NVD/CVE/CWEs, and experience managing FOSS CVE tracking.

- Experience in implementing secure coding practices aligned with OWASP Top 10, SANS Top 25, BDH, and Palo Alto advisories (a plus).

- Solid understanding of secure deployments on public and private cloud platforms like AWS, Azure, GCP, OpenShift, and VMWare.