Incident Response Product Security Engineer II
About The Position
Join Esri’s Software Security and Privacy team to help protect the technology organizations around the world use to understand and work with geographic information. This role sits at the intersection of software security, privacy, engineering, and product development, turning security challenges into improvements across Esri products and the ArcGIS platform. You will work with engineers, security professionals, product teams, and customers to identify, understand, and respond to emerging security and privacy risks. The position focuses on incident response and product security, including investigating security and privacy findings, evaluating application security, identifying risk patterns, communicating findings and metrics, and improving procedures. The role also collaborates with development teams on security best practices and related technical publications.
Requirements
- At least 2 years of experience with CSIRT, CIRT, or PSIRT functions in an enterprise-scale environment.
- Solid grasp of FIRST, OWASP Top 10, SANS Top 25, CVE, and other frameworks.
- Experience with Burp Suite or similar automated security testing tools.
- Deep knowledge of Windows, Linux, cloud computing, and networking concepts.
- Deep understanding of common security weaknesses and attack and defense methodologies.
- Strong written and verbal communication skills and proven attention to detail.
- Ability to track, lead, and set priorities for numerous parallel projects and tasks.
- Bachelor’s degree in computer science, engineering, information systems, data science, or a related field.
- Must be authorized to work for any employer in the U.S.; visa sponsorship is not available.
Nice To Haves
- Master’s degree in computer science, engineering, information systems, data science, or a related field.
- Experience with red/blue/purple team penetration-testing approaches.
- Extensive experience with ArcGIS software.
- Experience testing AI solutions for security flaws.
- Experience creating and testing security controls for FedRAMP or ISO certifications.
- Familiarity with coordinated vulnerability disclosure (CVD) processes.
- Scripting experience (such as Python, Perl, Ruby, or shell) or coding experience (Java, C++, or .NET).
Responsibilities
- Use the FIRST PSIRT Framework to implement and advance the Incident Response Lifecycle.
- Validate, research, and translate identified security and privacy findings into concise issues.
- Communicate the outcomes of vulnerability investigations.
- Facilitate red-teaming exercises to evaluate application security.
- Identify common patterns of vulnerability and privacy risk exposure.
- Communicate and present software security and privacy risk metrics.
- Write and maintain SOPs, processes, best practices, and procedural documents.
- Collaborate with development teams and contribute to security best-practice technical papers, security advisories, and blogs.
Benefits
- Medical, dental, and vision benefits.
- Basic and supplemental life insurance for employees and their families.
- 401(k) and profit-sharing programs.
- Minimum accrual of 80 hours of vacation leave.
- Twelve paid holidays throughout the calendar year.
- Opportunities for personal and professional growth.
Stand Out From the Crowd
Upload your resume and get instant feedback on how well it matches this job.
What This Job Offers
Job Type
Full-time
Career Level
Mid Level
