What technical skills, experience, and qualifications do you need?
Prior experience (3-5 years) in a Production Engineering or related position.
Experience working with Developers, DevOps, and Engineering teams in a dynamic environment to promote/implement the DevSecOps program throughout the organization.
Experience coordinating and performing vulnerability assessments through the use of automated and manual tools (SAST, DAST, IAST etc).
Ability to review and analyze vulnerability data to identify security risks to the organization's network, infrastructure, and application's and determine any reported vulnerabilities that are false positives.
Capability to prepare security vulnerability and risk management reports for management.
Leadership and teaming skills to coordinate remediation of vulnerabilities within established timeframes.
Experience generating and providing executive reports for vulnerability management across DevSecOps Security Products.
Proficiency in Java Programming, Bash, Powershell, Python, Terraform or other scripting languages.
Familiarity with Information Security frameworks/standards (i.e. CIS, NIST, RFC2196, etc).
Comprehension in the security areas of Key Management Systems, Certificate Management, Encryption, Penetration Testing, Vulnerability Scanning, Security and Monitoring tools, etc.
Experience configuring, implementing, and leveraging computer security and networking diagnostic/monitoring tools.
Knowledge of Windows and Linux patch management and related information security functions (authentication, encryption, iptables, SSL, Ciphers, etc)
Ability to work with APIs and Plugins to integrate security tools into established CI/CD pipelines.
Support code reviews across all code platforms
Manage security integration into the SDLC process at CSC
Help evolve CSC’s application security functions and services
Responsible for Security bug intake and remediation process for CSC
Responsible for leading the remediation of application vulnerability scanning and penetration testing
Manage integration with Static Application Security Testing (SAST) Software Composition Analysis (SCA), Dynamic Application Security Testing (DAST), Infrastructure as a Code (IaC) scanning, Secret Scanning, and Container Image scanning.
Identify security exposures and develop mitigation plans
Identify, report and fix technical debt.
Assist Manager of Application Security on all application security activities
Become a representative for the CSC Information Security program
Be productive and participate in security initiatives with minimal supervision.
Becomes a subject matter expert for security solutions within the CSC platform, knowledge of SANS 25 and Owasp Top 10.
Be able to act as a mentor for junior dev, devops and security engineers
Use the tools and technologies used throughout CSC InfoSec.
Own and document medium/large epics and follow through until completion.
Present security solutions to a larger CSC audience.
Troubleshoot issues and performance bottlenecks.
Follow Security best practices.
Collaborate with cross functional teams (Engineering, DevOps, Product) while carrying out day-to-day tasks.
Participate in requirement gathering with Product/SRE/InfraServices.
Collaborate with cross Business Unit teams (CLS, DBS, Corp Tax, TBS) on implementing standardized security solutions and integrations.
Participate in inner sourcing/procurement initiatives within CSC.
