Application Security Engineer

Teacher Retirement System of Texas•Austin, TX

12d•Onsite

About The Position

The Application Security Engineer is responsible for performing complex information technology, and cyber security analysis and control work. The incumbent will maintain the security and integrity of communication infrastructure systems and cybersecurity systems, as defined in Section 117.001(2) of the Texas Business and Commerce Code; and ensure the security of TRS applications by implementing and managing application security measures, working closely with the other Information Security team members, the IT department, application development teams, and business technologists to identify and mitigate security risks, develop and implement security protocols, and provide training and support to development staff.

Requirements

Bachelor’s degree from an accredited college or university in Cybersecurity, Information Technology, or a closely related field.
High school diploma or equivalent and additional full-time experience in cybersecurity, information security, systems analysis, programming, computer operations, IT business analysis or related experience may be substituted on an equivalent year-for-year basis.
Must have the ability to maintain the security and integrity of communication infrastructure systems and cybersecurity systems, as defined in Section 117.001(2) of the Texas Business and Commerce Code, and:
Four (4) years of full-time directly related, progressively responsible experience in cybersecurity, information security, systems analysis, programming, computer operations, IT business analysis or related experience.
One (1) year of full-time directly related, progressively responsible experience developing and training employees on security/privacy policies, data handling practices and procedures, and legal obligations or related experience.
One (1) year of full-time directly related, progressively responsible experience conducting IT audits and needs analysis to improve business process solutions. As well as developing and writing IT policies, procedures, and audit responses or related experience.
Experience may be concurrent.
A master's degree or doctoral degree in a closely related field may be substituted on an equivalent year-for-year basis.
Certification as a Certified Information Systems Security Professional (CISSP), or other security related certifications.
Knowledge of: Computer systems and technology limitations, capabilities, and security infrastructures.
Knowledge of: Information security systems, controls, methodologies, practices, and regulations, including data encryption and information protection.
Knowledge of: National and international laws, regulations, policies, along with ethics as they relate to cybersecurity/privacy.
Knowledge of: Organization’s risk tolerance and/or risk management approach.
Knowledge of: Applicable state and federal laws, statutes, Presidential Directives, executive branch guidelines related to information security or cyber security.
Knowledge of: Common security flaws and ways to address them (e.g., OWASP Top 10, CIS Top 18).
Knowledge of: Current and emerging cyber technologies.
Knowledge of: Agile methodology.
Knowledge of: Common code repository and continuous delivery tools.
Skills in: Analyzing complex technical problems and developing workable solutions
Skills in: Managing multiple conflicting tasks/deadlines.
Skills in: Effective verbal and written communication of complex technical information.
Ability to: Effectively assess areas of risk associated with information security.
Ability to: Determine the validity of technology trend data.
Ability to: Develop policy, plans, and strategies in compliance with laws, regulations, policies, and standards in support of organizational information security assurance.
Ability to: Establish and maintain harmonious working relationships with co-workers, agency staff, and external contacts.
Ability to: Work effectively in a professional team environment.

Nice To Haves

Experience with risk management frameworks as it pertains to the National Institute of Standards and Technology.
Experience with various security monitoring tools, network and web assessment tools, and automation techniques.
Basic development or scripting experience and skills. (.Net, Python, and Java are preferred.)
Experience with identifying security issues through code review.
GIAC 500 series or higher certifications, OSCP, or other security related certifications.

Responsibilities

Works with application development teams to develop and implement secure coding practices, including coding standards, code reviews, and security-focused testing.
Develops and execute a process for regular application security assessments, including code reviews, threat modeling, and design reviews.
Develops and maintain a library of secure coding resources for application developers.
Develop and implement application security policies and procedures that align with industry standards and best practices.
Provides regular reports to the Information Security Leadership on the status of application security assessments.
Work with application development teams to prioritize and remediate identified vulnerabilities.
Provide training and support to application developers on secure coding practices.
Monitor and enforce compliance with application security policies, procedures, and tooling.
Collaborate with the IT department, Information Security team, and application development teams to design and implement security controls and measures, including access controls, encryption, and network segmentation.
Performs related work as assigned.