Senior Cybersecurity Engineer, Applications
Meso Scale DiagnosticsPOSITION SUMMARY: This position is a member of the cybersecurity team responsible for improving the cybersecurity posture across the organization. The principal focus of this position is application security, bringing depth in securing software, applications, and the environments in which they are built and deployed. The incumbent also contributes across the broader cybersecurity program and is responsible for maintaining knowledge of current trends in the industry. DUTIES AND RESPONSIBILITIES: Analyze, investigate, respond to, and recover from cybersecurity incidents, events, and threats as per the incident response lifecycle. Remediate application vulnerabilities and guide engineering/development teams to take preventative measures. Integrate security into the software development lifecycle, including static analysis, dynamic analysis, and software composition analysis within build and deployment pipelines. Conduct threat modeling and secure design reviews for new and existing applications, and provide security recommendations to development and architecture teams. Represent security in architecture design reviews and the Change Advisory Board to ensure security considerations are addressed before changes are approved. Assess and improve the security of application hosting environments, including AWS workloads and containerized platforms. Coordinate external application penetration testing and manage findings through remediation. Engineer security solutions to mitigate risk and improve the security posture of MSD. Assist with the development and maintenance of security tools, techniques, and procedures to facilitate security testing, vulnerability detection, validation, and mitigation. Understand and evaluate best practices against COTS (Commercial Off-The-Shelf) application as well as custom developed applications. Assist with the evaluation and assessment of different security technologies to appropriately expand MSD’s cybersecurity portfolio. Stay abreast of relevant Application Security and Cloud related industry updates and changes via conferences, training and events. Assist with the continuous improvement of security posture and provide hands-on cybersecurity support to address Cybersecurity issues as needed. Collect, report and continually enhance security metrics. Continually monitor and maintain an understanding of the security posture of application development tools, technologies and libraries. EXPERIENCE AND QUALIFICATIONS: Bachelor's degree in MIS, computer science, computer engineering or related field with a concentration in cybersecurity, or an equivalent combination of education and relevant experience. Minimum of 5 years of relevant work experience in cybersecurity, including demonstrated depth in application or software security. Broader experience across other cybersecurity disciplines is valued, as this position contributes to the wider security program. Life sciences experience is a plus. Experience working in regulated or validated environments is strongly desired. Industry certification such as GWAPT, GWEB, OSWE, CSSLP, OSCP, or CISSP is a plus. KNOWLEDGE, SKILLS AND ABILITIES: Knowledge of secure coding best practices and frameworks, and of software supply chain risk including dependency management and artifact repository controls. Working knowledge of OWASP resources, including the Top 10 and Application Security Verification Standard, and hands-on experience with static analysis, dynamic analysis, and software composition analysis tooling. Experience securing applications built on Java or .NET stacks. Familiarity with the development practices and common weaknesses of at least one is required. Knowledge of API security and of authentication and authorization technologies including SSO, OAuth, OIDC, and SAML, and of session management practices. Working knowledge of Amazon Web Services and cloud security controls for application workloads, including container and Kubernetes security. Knowledg…