We are seeking an experienced Lead Cybersecurity Engineer to support security-by-design practices, secure application development, security testing, and DevSecOps integration. The ideal candidate will have strong application security expertise, cloud security experience, and the ability to collaborate with development teams to identify, assess, and remediate security vulnerabilities.
Key Responsibilities:
Analyze, validate, communicate, and manage security defects identified through CodeQL, Rapid7, penetration testing, bug bounty programs, and other security assessments.
Provide security guidance to software engineers, architects, product owners, and technical leaders.
Support secure SDLC practices, threat modeling, security architecture, and risk analysis.
Enable, configure, and monitor automated security scanning tools at the repository and application levels.
Manage SAST, DAST, and SCA findings and coordinate vulnerability remediation.
Support penetration testing and security assurance assessments, including scope definition, access coordination, and defect tracking.
Assess and improve the security of AWS and/or Azure cloud environments.
Integrate security practices into CI/CD pipelines and DevOps workflows.
Collaborate with development teams to ensure applications and services meet enterprise security requirements.
Required Qualifications:
Bachelor's degree in Computer Science or a related field with 8+ years of information security experience; alternatively, a master's degree with 6+ years of experience.
Strong knowledge of application security vulnerabilities and remediation, including OWASP Top 10, CWE/CVE, and SANS Top 25.
Experience with enterprise security architecture, threat modeling, vulnerability assessments, risk analysis, and defense-in-depth principles.
Strong understanding of secure SDLC, identity and access management, API security, SAST, DAST, and SCA.
Hands-on experience with AWS and/or Microsoft Azure security.
Development experience with Java, Python, .NET, JavaScript, or equivalent languages.
Experience with security automation and scripting.
Strong communication skills, including the ability to explain technical security concepts to non-security stakeholders.
Ability to coordinate across multiple teams and drive security process improvements.
Professional certifications such as CISSP, CCSP, CSSLP, GWAPT, GWEB, or AWS Security certifications are desirable.
AI fluency is preferred.
Preferred Qualifications:
Web services and API security expertise.
Experience with security scanning tools such as CodeQL and Rapid7.
Strong understanding of information security technologies and enterprise security controls.
