Senior Product Security Engineer

Descrizione

We’re Hiring for a Senior Product Security Engineer!

If you are excited and passionate about helping #LetsSolveWater, consider joining our team today!  Xylem, Inc. is a leading global water technology company servicing more than 150 countries and is dedicated to solving the world’s most challenging water issues.  We are looking for individuals to join our mission by exceeding customer expectations through smart sustainable solutions.  At Xylem, you will have the opportunity to solve water by participating in our paid Volunteer Program, Xylem Watermark!

As member of Xylem’s Product Security team, the Senior Product Security Engineer is responsible for the implementation and execution of security programs and practices to support a growing, global water technology company.  This position will work across software and firmware development teams to identify component and system level technical risks and evaluate critical failure points, determine technical security controls to mitigate risks, and work with cross functional teams to implement features according to product road maps.

You will support security standards implementation, penetration testing and PSIRT programs of for our entire product portfolio. Your passion for security and in-depth knowledge of Product Security will ensure that you deliver high impact results.

Essential Duties/Principal Responsibilities:

• Work with the business, devops and systems teams to support security integration into implementing new solutions, products and modules
• Conduct security architecture and technical assessments for a wide range of products, including embedded devices, enterprise software solutions, and mobile apps
• Engage in application and domain-specific threat modeling and attack surface analysis and reduction
• Provide guidance and leadership on best practices regarding security in software and firmware development
• Champion the Xylem security SDLC. This includes security testing, penetration testing, and identifying and fixing vulnerabilities in software and applications on all Xylem products.
• Implement or manage the implementation of common application security controls
• Assist other developers in remediating vulnerability findings by providing line-by-line guidance.
• Provide training and education to developers on software security best practices.
• Deliver key shared services to Xylem business units in the areas of software security, risk management, product inventory, and security testing

Required Qualifications:

Minimal education & experience, essential skills & abilities and required license/certification to perform this job.

• BS in Computer Science or equivalent with 7 to 10 years of experience
• Demonstrated expertise in product/application security architecture, Network security, application security, web services
• Experience with SAST, DAST, SCA and penetration testing tools
• In-depth experience identifying and protecting against web application and web service security vulnerabilities including those found in the OWASP Top 10 IoT Top 10 and CWE Top 25
• Meaningful experience in multiple programming languages
• Solid knowledge of the browser security model, crypto, and network security. Attacker mindset: Real passion for breaking all the things unbreakable.
• Knowledge of secure infrastructure architectures, application architectures, encryption, Cloud Security and broader security technologies.
• Strong operating systems knowledge Windows (all flavors),  Debian Linux
• Experience on firmware security” or “IoT security” or “platform Security” any one is a must.
• IoT network technologies (such as Bluetooth/BLE, WLAN, Z-Wave, Zigbee, identity/auth security)
• Experience with wireless technologies such as CDMA, E-HRPD, GSM, UMTS, TDS-CDMA, LTE-FDD / LTE-TDD, and 5Gexperience with Android RIL, Telephony, C and Embedded RTOS.
• Scripting knowledge Linux scripting (bash), Windows scripting, Python or Perl
• Awareness of secure coding, especially in OWASP top 10
• Good knowledge or experience in software security such as crypto, encryption, PKI, web security
• OSCP & GWAPT

Preferred Qualifications:

• Relevant cyber security certifications
• Scripting skills (i.e.: Ruby, Python, Perl, shell scripts)
• Experience in software development
• Experience with cloud IaaS security operations
• Valuable: Preferred: forensic analysis skills

SALARY:   
The estimated salary range for this position is $150,000 to $170,000 plus bonus.   Starting pay is dependent on multiple factors, such as skills, experience and work location, and is not typically at the top of the range.  At Xylem we offer a competitive compensation package with a generous benefit package, including Medical, Dental, Vision plans, 401(k) with company contribution, paid time off, paid parental leave and tuition reimbursement.

At Xylem, we embrace diversity and strive to create avenues where employees feel valued and appreciated through our DE&I initiatives and Employee Resources Groups (ERG).  Xylem is proud to be an Equal Employment Opportunity and Affirmative Action workplace.  Xylem prohibits discrimination, harassment of any kind and does not discriminate in employment on the basis of race, color, religion, sex or sexual orientation (including pregnancy and gender identity), national origin, political affiliation, marital status, medical conditions or disability, genetic information, age, or other non-merit factors.

Join the global Xylem team today!  Xylem is a team creating advanced technology solutions to the world’s water challenges through developing new technologies and services that will improve the way water is used, conserved, and re-used in the future is central to our work. Our products and services move, treat, analyze, monitor, and return water to the environment, in public utility, industrial, residential, and commercial building services settings. Xylem also provides a leading portfolio of smart metering, network technologies and advanced analytics solutions for water, electric and gas utilities.

Disclaimer: The information listed within this job description is designed to indicate the general nature of work expected for this position and shall not be viewed as a comprehensive inventory of all duties, responsibilities, and qualifications required in this position.  Employees must be able to perform the essential functions of the position satisfactorily and if requested, reasonable accommodations will be made to enable employees with disabilities to perform the essential functions of their job absent undue hardship.  Xylem reserves the right to modify this job description or assign other duties to this position as needed.

Keywords

Product SecurityEngineerSecurityArchitectureNetworkApplicationWeb ServicesSASTDASTPenetration TestingOWASPIoTProgramming LanguagesBrowser SecurityCryptoNetwork SecurityInfrastructureCloud SecurityFirmware SecurityIoT SecurityWireless TechnologiesScriptingSecure CodingSoftware SecurityOSCPGWAPT