Position: Middle/Senior Application Security Engineer
Company: UnameIT
Experience required: 3y
Category: Security
English level: upper
Published: 2022-06-01T00:00:00+03:00

**About the role**

Provides expert technical guidance to product teams in performing the daily, weekly, and monthly security activities as part of our Secure SCRUM process.
Performs validation of security controls during design, development, testing, and deployment of systems that support our products and services. 

TechOps is the result of an evolution from demand, project delivery and IT operations into a continuous delivery model, with a value stream having end-to-end responsibility. Our main objectives are to ensure business continuity, drive employee experience and to provide the foundation for digital transformation. In this role, you’ll have the potential to transform our business and your career. We’re a meritocracy, with plenty of room for growth and development, so you know your hard work will be rewarded.
We encourage you to think big and go after your goals. You’ll get to be creative, work with diverse teams so you can build a global network and have direct control over your career and where it takes you.



**Business environment**

Key dimensions: (Zone application security health, Zone ZBB and operations targets, NPS, Application technical debt, Number of application vulnerabilities)

ABI IT Solutions landscape for the Applications domain of extremely diverse landscape comprising of different technology stacks, off-the-shelf and proprietary built solutions, both integrated and non-integrated including legacy systems built / acquired through our M&A growth model

Europe geographical markets: 16 Countries
     Located in Europe with daily interaction within a virtual organization spread across
     Western Europe, Ukraine, and offshore locations

All business processes, especially critical ones (Sales & Supply)

Direct reports: 0

Indirect reports: from 0 to ~40, depending on the projects running
Vendors & Partners involved in projects / solution development
Zone and Global TechOps (IT Operations) teams
Zone and Global Digital Transformation Project / DevOps teams
Zone and Global Cybersecurity teams

Key contacts: (internal-external)		

INTERNAL 

Zone Enterprise Architecture, App Security & Software Licencing Lead
Zone Solutions Directors 
Zone Application Support Lead
Zone and Global Services and Performance Managers
Zone and Global Procurement
Zone Architects
Zone IT Ops Managers
Zone IT Infra Leads (Network, Workplace, Cloud & DC)
Zone and Global Cybersecurity teams (including Global SOC)
Zone Licencing manager & Global SAM CoE
Zone Value Creation team
Zone and Global Project Managers / Transformation leads
Zone Scrum Masters, Product Owners and DevOps teams

EXTERNAL

Vendor/Supplier Key Account Managers, Directors, Sales leads, Architects, Developers (e.g. IBM, Infosys, Insight, Oracle, Microsoft, Salesforce, SAP, etc…)

Peer companies’ Architects / Directors / Engineers (Pepsi, P&G, Unilever, Heinz, etc)

**Accountabilities**

Accountable for:

Working with the global Apps Security team to understand and implement best practices on application security tools and processes in the zone.
Playing a key role for driving understanding and adoption of application security testing/scanning tools within product teams in the zone.
Defining and contributing to guidelines / standards on secure software development.
Working with the global DevSecOps team, responsible for our SAST, SCA, and DAST tools to configure an efficient technology-specific scanning profile, perform rule finetuning to reduce the rate of false-positive and provide remediation assistance to application engineers / product teams in the zone.
Supporting product owners in creating security user stories and security acceptance criteria.
Assisting product engineers to compose and execute attacker abuse cases.
Performing design reviews, threat modeling, and source code review and drive remediation of the discovered vulnerabilities
Supporting security assessments (penetration testing) on externally and internally facing applications to discover risk and guide & track their resolution.
Understanding, balancing, and communicating business risk with a security risk.
Performing research and maintain an extensive knowledge base of current security technology advancements, trends, and developments for retail industries.
Acting to bring continuous improvement to DevSecOps processes and tools.



Qualifications and competencies required

Education:
University degree in Computer Science / Computer Engineering / Software Engineering
or similar degree / through experience

Who we are looking for:
People with good leadership, stakeholder and communication management skills
People strong on foundations in software engineering & design and threat modeling
Curious, ambitious, and resilient people who thrive in fast-moving environments
Open-minded individuals who are flexible and enjoy change
Strategic thinkers who are always on the lookout for ways to improve and grow
People as comfortable working in a team as they are on their own
English speakers (additional language is a plus)
Experience with Docker containers and Kubernetes
Experience with multiple languages such as Java, HTML, Python, APEX, Kotlin, Swift, .NET, Node.js, PHP 
Experience in Web Application technologies e.g. REST APIs, Microservices, Containers
Understanding of how to detect and remediate security issues such as OWASP Top 10
Knowledge of Software Development and SDLC and governance methodologies e.g. Scrum
Experience in Application testing, monitoring and trouble shooting
Experience with SAST, DAST tooling e.g. Checkmarx, Snyk, Qualys, etc
Security community participation (conference speaker, tool development contributor) is highly preferred
Ability to make information security risk-based prioritization decisions and trade-offs
Exceptional technical documentation and reporting

**Certifications (recommended but not mandatory)**
CISSP / CISM / CISA / CEH / SSCP
Azure / Google Cloud / AWS / SAP / Salesforce technologies