Incident Response Product Security Engineer II

Esri • Redlands, CA

20h • Onsite

About The Position

Join Esri’s Software Security and Privacy team to help protect the technology organizations around the world use to understand and work with geographic information. The role sits at the intersection of software security, privacy, engineering, and product development, translating security challenges into improvements across Esri products and the ArcGIS platform. The engineer works with engineers, security professionals, product teams, and customers to identify, understand, and respond to emerging security and privacy risks.

Requirements

• At least 2 years of experience with CSIRT, CIRT, or PSIRT functions in an enterprise-scale environment.
• Solid grasp of FIRST, OWASP Top 10, SANS Top 25, CVE, and other frameworks.
• Experience with BURP Suite or similar automated security testing tools.
• Deep knowledge of Windows, Linux, cloud computing, and networking concepts.
• Deep understanding of common security weaknesses and attack and defense methodologies.
• Strong written and verbal communication skills and proven attention to detail.
• Ability to track, lead, and prioritize numerous parallel projects and tasks.
• Bachelor’s degree in computer science, engineering, information systems, data science, or a related field.
• Must be authorized to work for any employer in the United States; visa sponsorship is not available.

Nice To Haves

• Master’s degree in computer science, engineering, information systems, data science, or a related field.
• Experience with red-team, blue-team, or purple-team penetration-testing approaches.
• Extensive experience with ArcGIS software.
• Experience testing AI solutions for security flaws.
• Experience creating and testing security controls for FedRAMP or ISO certifications.
• Familiarity with coordinated vulnerability disclosure (CVD) processes.
• Scripting experience (such as Python, Perl, Ruby, or shell) or coding experience (Java, C++, or .NET).

Responsibilities

• Use the FIRST PSIRT Framework to implement and advance the incident response lifecycle.
• Validate and research security and privacy findings, then translate them into concise issues.
• Communicate the outcomes of vulnerability investigations.
• Facilitate red-teaming exercises to evaluate application security.
• Identify common patterns of vulnerability and privacy risk exposure.
• Communicate and present software security and privacy risk metrics.
• Write and maintain SOPs, processes, best practices, and procedural documents.
• Collaborate with development teams and contribute to security best-practice technical papers, security advisories, and blogs.

What This Job Offers

• Job Type: Full-time
• Career Level: Mid Level