Incident Response Product Security Engineer II
About The Position
Join Esri’s Software Security and Privacy team to help protect the technology organizations use to understand and work with geographic information. The role sits at the intersection of software security, privacy, engineering, and product development, translating security challenges into improvements across Esri products and the ArcGIS platform. The engineer will work with engineers, security professionals, product teams, and customers to identify, understand, and respond to emerging security and privacy risks. The role involves investigating vulnerabilities, evaluating application security, communicating risks and findings, and helping teams build more secure software.
Requirements
- At least 2 years of experience with CSIRT, CIRT, or PSIRT functions in an enterprise-scale environment.
- Solid grasp of FIRST, OWASP Top 10, SANS Top 25, CVE, and other frameworks.
- Experience with BURP Suite or similar automated security testing tools.
- Deep knowledge of Windows, Linux, cloud computing, and networking concepts.
- Deep understanding of common security weaknesses and attack and defense methodologies.
- Strong written and verbal communication skills and proven attention to detail.
- Ability to track, lead, and set priorities for numerous parallel projects and tasks.
- Bachelor’s degree in computer science, engineering, information systems, data science, or a related field.
- Must be authorized to work for any employer in the U.S.; visa sponsorship is not available.
Nice To Haves
- Master’s degree in computer science, engineering, information systems, data science, or a related field.
- Experience with red, blue, or purple team penetration-testing approaches.
- Extensive experience with ArcGIS software.
- Experience testing AI solutions for security flaws.
- Experience creating and testing security controls for FedRAMP or ISO certifications.
- Familiarity with coordinated vulnerability disclosure (CVD) processes.
- Scripting experience (such as Python, Perl, Ruby, or shell) or coding experience (Java, C++, or .Net).
Responsibilities
- Use the FIRST PSIRT Framework to implement and advance the incident response lifecycle.
- Validate and research identified security and privacy findings, and translate them into concise issues.
- Communicate the outcomes of vulnerability investigations.
- Facilitate red-teaming exercises to evaluate application security.
- Identify common patterns of vulnerability and privacy risk exposure.
- Communicate and present software security and privacy risk metrics.
- Write and maintain SOPs, processes, best practices, and procedural documents.
- Collaborate with development teams and contribute to security best-practice technical papers, security advisories, and blogs.
Benefits
- Medical, dental, and vision benefits.
- Basic and supplemental life insurance for employees and their families.
- 401(k) and profit-sharing programs.
- Minimum accrual of 80 hours of vacation leave.
- Twelve paid holidays throughout the calendar year.
- Opportunities for personal and professional growth.
Stand Out From the Crowd
Upload your resume and get instant feedback on how well it matches this job.
What This Job Offers
Job Type
Full-time
Career Level
Mid Level
