Info Protection Advisor-App Security Eng- Hybrid

Cigna Group•Bloomfield, CT

3d•Hybrid

About The Position

Cigna-Evernorth Services Inc. seeks an Info Protection Advisor – Applic Security Eng for the Bloomfield, CT location to collaborate with software development teams to lead and support Application Security activities that guide the design, development and security of code and code repositories for cloud-hosted and open-source applications.

Requirements

Bachelor’s degree in Computer Science or related field and 5 years of experience.
Integrating security at every phase of the Software Development Lifecycle
Identifying potential threats and vulnerabilities early in the design phase
Using SAST/DAST tools and techniques to analyze source code and running applications for vulnerabilities
Utilizing secure coding standards, including OWASP Top 10 and SEI Cert, across multiple languages
Identifying, prioritizing, and remediating vulnerabilities using tools including Nessus, Qualys, and Burp Suite
Secure identity management including authentication, authorization mechanisms, and role-based controls using tools including OAuth, SAML, and JWT
Embedding security into CI/CD pipelines
GitHub Actions for DevSecOps Integration
Jenkins for DevSecOps Integration
Securing applications deployed in cloud environments, including container security
Assessing application risk and compliance with security standards including NIST and ISO 27001
Detecting, analyzing, and responding to application-level security incidents.

Responsibilities

Assist with the inspection of application code for security issues, building a new framework to help our software developers deploy faster and more securely through CI/CD Integration, or performing assessments on existing software development lifecycle practices to ensure security standards are met.
Act as a subject matter expert on application security to improve and further integrate security best practices into product design and software development lifecycles (SDLC) of the organization.
Perform focused risks assessments of existing or new services and technologies, security architecture, identifies design gaps, risks, and recommends security enhancements.
Assist development teams with secure code reviews and other AppSec assessments to educate development teams on security weaknesses and vulnerabilities.
Assist with the implementation and management of automated security controls as part of CICD pipelines and DevSecOps philosophies.
Assist with the education of development teams on the remediation of vulnerabilities detected in SAST, SCA, and DAST security tools.
Establish and maintain secure coding standards and best practices to provide guidance and training to development teams on security best practices.