Application Security Architect

WEXWEXUS•Boston, OH

46d•$109,300 - $133,000

About The Position

Wex, Inc. is looking for an Application Security Architect with broad software development and application security experience. This individual would be responsible for designing, guiding, and assessing security solutions in software projects to ensure that security is built in from the beginning. With the assistance of tools including SAST, DAST and SCA, perform assessments of software projects to identify security issues and guide teams to effective remediations. We’re the Global Product Security Team at WEX, responsible for enabling a modern and effective Secure Software Development Lifecycle throughout WEX. We partner closely with internal teams and customers to assure WEX operates in a secure and compliant manner. Our team holds itself to a high-standard and we collaborate closely with one another to ensure strong, reliable and effective relationships. We own our results and we take pride of ownership in everything we do.

Requirements

Subject Matter Expert in software development and software security, particularly with web applications, APIs, mobile apps, and enterprise applications delivered in a SaaS model.
Experience with common application security issues, e.g., OWASP Top 10, and appropriate mitigation strategies.
Ability to troubleshoot security issues within a complex on-prem and multi-cloud environment.
Experience working closely with many teams across departmental and business unit boundaries.
Ability to commit and deliver on very specific project/delivery timelines with minimal supervision.
Excellent communication skills, both written and verbal.
3-5+ years of progressive experience in software development. C#, Java, Go or Python preferred.
3+ years experience with software security or information security.
2+ years experience with application and container security tools such as SAST, DAST, SCA, IaC scanning and container image scanning, including integrating them to build and ticketing tools.
A degree in Business, Computer Science or equivalent combination of education and relevant experience.

Nice To Haves

Security certifications such as CEH, OSCP, GWAPT or similar and cloud certifications.
Understanding of modern CI/CD approaches and tooling, preferably with multiple toolsets such as Azure DevOps, GitHub Actions, Jenkins and others.
Experience with designing and securing container technologies - Kubernetes, Docker, EKS, ECS, AKS, service mesh.
3+ years of cloud hosted applications and public cloud experience (IaaS, PaaS, FaaS, SaaS).
Experience working on agile teams.

Responsibilities

Design, guide, and assess security solutions in software projects.
Perform assessments of software projects using tools like SAST, DAST, and SCA to identify security issues.
Guide development teams to effective security remediations.
Work closely with development teams on securing Wex's applications.
Mentor other engineers & architects on your team and other teams both technically and professionally.
Champion a shift-left and DevSecOps approach to security.
Perform manual and automated secure code reviews.
Perform web application and mobile app penetration testing.
Deliver actionable security guidance to project teams.
Analyze security assessments and effectively communicate requirements to appropriate software development, network, and configuration management teams.
Actively participate in Security Development Lifecycle efforts such as performing secure architecture reviews, secure code reviews, threat models, and penetration testing.
Identify and partner with security champions in the development organization to scale security expertise and awareness.
Write comprehensive reports including assessment-based findings, outcomes, and recommendations for security enhancement.