IT Application Security Architect (Hybrid)

Eversource•Manchester, NH

60d•Hybrid

About The Position

As the Application Security Architect, and part of the Cybersecurity Architecture team at Eversource, you will work alongside other cybersecurity specialists within the Cybersecurity, Network, and Compliance organization. You'll have the opportunity to apply your knowledge across multiple projects and collaborate across multiple business lines and technical domains. You will aid the firm in remaining at the forefront of industry trends, best practices, and technological advances in application cybersecurity. The Application Security Architect will interact with the technology and business colleagues associated with projects. They will deliver project level planning, design, and implementation of security solutions and controls related to Secure Software Development Life Cycle (SSDLC) (e.g. code review, risk assessments, threat modeling, static code analysis, and dynamic application scanning) One of your primary tasks will be to get deeply involved in security issues around secure coding and secure design. You will assist others in resolving security issues by offering alternative coding solutions and other means. You will also work with project teams to incorporate security into the design architecture. The Application Security Architect will continuously raise the security bar by promoting a security mindset and educating application developers regarding Eversource security practices. They will cultivate a security culture as you interact with the developers, project teams, and business areas.

Requirements

Bachelor's degree in Information Systems or a related technical field or equivalent experience
5+ years applied experience in application security or related position.
Must have a background performing cybersecurity code analysis. This includes identifying and resolving false positives, explaining vulnerabilities in simple terms to project teams, and providing remediation recommendations to development teams.
Experience with software composition analysis and tools to scan source and binary code for the purpose of identifying dependency vulnerabilities.
Experience with implementing and using static and dynamic analysis tools. Experience performing penetration testing is preferred.
Experience using and/or maintaining Checkmarx, Burp Suite, or Contrast preferred.
Experience with DevSecOps. Experience with automating security operations within CICD workflows preferred.
Experience in writing code using a major programming language is preferred. Specifically, .NET.
Experience with cloud methodology and terminology. Experience working with cloud-based platforms and applications. Experience with Azure is preferred.
Exhibits an exceptional degree of ingenuity, creativity and/or resourcefulness.
Produce high quality oral and written work, presenting complex technical matters clearly and concisely with audiences ranging from peers to Sr. Management.
Familiarity with current and proposed laws, regulations, industry standards, and ethical requirements related to information security and privacy.

Nice To Haves

Bachelor's degree or equivalent in Engineering, Computer Science, Data Science or Information Technology is preferred.
Azure cloud certification(s), or similar cloud certifications preferred.
Industry security certifications such as CISSP, CCSP, Azure certifications, HTB Certified Penetration Testing Specialist, or OSCP preferred.

Responsibilities

Assess the current design and codebase to identify areas in need of improvement. Work with members of project teams to resolve security issues.
Must work seamlessly with the Eversource developers to ensure the successful adoption of required security approaches and capabilities.
Conduct threat modeling for new and existing applications. Perform security testing such as static code analysis, pentesting, and dynamic application security testing.
Apply a cybersecurity background to perform code analysis when resolving false positives and provide remediation recommendations.
Establish application security requirements based on company standards and industry best practices.
Develop and maintain infrastructure as code security policies.
Test and evaluate security tools, and products.

Stand Out From the Crowd

Upload your resume and get instant feedback on how well it matches this job.

Upload and Match Resume