Position: Security Engineer
Company: Zoolatech
Experience required: 3y
English level: upper

Together with the Zoolatech team, Procore Technologies develops a platform that allows you to effectively manage the construction of houses, hospitals, data centers, stadiums, and schools. At the same time, it makes the management of finances, quality, teams, and risks transparent, convenient, and compliant with laws.

Procore has been actively growing even during the latest year and the pandemic and moreover, it went public this year. Procore is a specialist in the construction management domain, and at the same time, it is also a very tech company that takes security and efficiency seriously. You have the opportunity to become part of a large US team and work closely with high-level AppSecEngineers, SecDevOps, and Engineers, and bring the team to the next new level of quality.

If you are an experienced security engineer or just a regular developer or a DevOps who has been actively involved in resolving security issues during your work and you have a desire to further develop yourself as a security specialist, this is a great opportunity for you to gain new experience and hone your skills.

Responsibilities
* Be a proactive member of the security team that drives complex security efforts for internal and external customers
* Own security decisions across Procore including identifying, planning, and applying security advance concepts and principles
* Advocate for security as a subject matter expert across multiple organizations, holding discussions on security topics and drive automation where required
* Design, build and review security-related services and functionality of web applications, mobile applications, and desktop applications
* Provide Procore's Engineering team with well-researched security advice to demonstrate vulnerabilities, collaborate with all teams to provide secure development guidance
* Triage vulnerabilities that are found internally or reported through our bug bounty program; serve as an escalation point of contact
* Conduct threat modeling, penetration testing, data security, DevSecOps, vulnerability management, and security metrics
* Work across Ruby on Rails, Apache, Nginx, PostgreSQL, AWS tech stacks

Skills Required
* BS degree in Computer Science or equivalent practical experience, MS in Computer Science preferred
* 4+ years of combined experience in Security, Software Engineering, and DevOps, with coding experience in an object-oriented language in a SaaS multi-tenant environment
* Experience leading small initiatives with the ability to course-correct as needed
* Experience with conducting threat assessments and creating remediation plans based on the results of threat assessments
* Experience with penetration testing, threat modeling, open-source, and commercial security tools
* Experience with some of the following technologies is preferred:
** AWS and tools (GuardDuty, Tenable, Cloudconfirmity, Macie, Snyk, Cloudfront)
** Infrastructure/cloud automation tooling (e.g. CloudFormation, Terraform, Packer)
** Service Mesh/Discovery Tooling (e.g. Consul, Envoy, Istio, etc)
** Continuous Integration (e.g. Circle CI, Jenkins)
** Containers and Container Management (Docker, Kubernetes, Helm, Spinnaker)
** Configuration and Security Management (e.g. SSL Certs, Puppet, Ansible, Salt, Vault, KMS)
** Security Tools: (Scanners, Interactive security testing tools, Burp Suite)
* Technical Certifications are a plus (GIAC, OCSP, CISSP, OSCP)