Software Security Master
Core
Senior technical specialist enabling end-to-end software security across the development lifecycle, acting as a security subject-matter expert for engineering teams.
Role type
Senior IC software security engineer (DevSecOps)
Builds
Secure software products and features with embedded security controls
Domain
Telecommunications, cloud-native platforms, distributed systems
Deliverable
production ML models | product features
Required skills
threat modeling, security risk assessments, secure coding, code reviews, vulnerability analysis, security testing, CVE analysis, vulnerability remediation, CI/CD integration, SAST/DAST/SCA, secrets detection, penetration testing, API security, IAM, network security, cryptography, data protection, Kubernetes, containers, Cloud Native technologies, Infrastructure as Code, security automation
Preferred skills
telecommunications, cloud-native platforms, distributed systems, complex software environments, OWASP, CWE/SANS Top 25, NIST, ISO 27001, CISSP, CSSLP, OSCP, GIAC
Technologies
SAST, DAST, SCA, Kubernetes, containers, Cloud Native, Infrastructure as Code
Responsibilities
Drive security by design throughout the software development lifecycle; Conduct security and privacy risk assessments and threat modeling; Identify security risks, attack surfaces, sensitive data, trust boundaries, and required security controls; Translate identified risks into security requirements, mitigations, and verification activities; Promote secure coding, least privilege, defense in depth, secure authentication and authorization, and data protection practices; Perform or coordinate security design reviews, secure code reviews, and root-cause analysis of security issues; Integrate automated security controls into CI/CD pipelines; Analyse CVEs and vulnerabilities affecting applications, platforms, containers, cloud services, operating systems, and third-party dependencies; Assess vulnerability severity, exploitability, impact, remediation actions, and target resolution dates; Coordinate remediation of critical and high-severity security findings; Plan and review penetration testing, vulnerability assessments, and security verification activities; Ensure security risks, test results, remediation actions, and release evidence are properly documented and traceable; Provide security guidance for release readiness, deployment, and post-release activities; Coach developers, architects, testers, DevOps, SRE, and operations teams on secure development practices; Promote security awareness and knowledge sharing across engineering teams; Collaborate with product, engineering, architecture, privacy, legal, compliance, operations, and security stakeholders.
Seniority
Senior, hands-on IC
