Lead Cybersecurity Engineer

Diversified Services Network, Inc.•Chicago, IL

3d•$155,000 - $160,000•Hybrid

About The Position

As a Lead Cybersecurity Engineer, you will contribute to Security by Design practices, secure application software development lifecycle practices, security testing and assessment, and the integration of security with DevOps. This role is responsible for security engineering of cloud environments (AWS, Azure) and vulnerability management across both Infrastructure as Code (IaC) and application development (SAST/DAST). You will help development teams identify and track security risks to remediation while embracing concepts of agile delivery and DevOps. This role owns a dedicated set of applications and works directly with development teams as part of a larger security engineering organization that sets standards and ways of working for engaging with those teams. You will help development teams identify security gaps in their applications and services and collaborate on solutions that bring services into compliance with enterprise security requirements.

Requirements

Bachelor's degree in Computer Science or a related field with 8+ years of experience in information security OR Master's degree with 6+ years of experience.
Application security expertise, including understanding of vulnerabilities and remediation solutions (OWASP, CWE/CVE, SANS 25).
Experience with a wide variety of information security processes and principles, such as enterprise security architecture, threat modeling, vulnerability assessment, risk analysis, defense in depth, SDLC and product development processes, identity and access management, API security, and SCA/SAST/DAST.
Cloud security experience with Microsoft Azure and/or AWS.
Professional certification such as CISSP, CCSP, GWAPT, GWEB, or AWS Certified Security - Specialty.
Development experience in Java, Python, .NET, JavaScript, or an equivalent language.
Experience implementing automation and scripting.
Excellent written and verbal communication skills, with a demonstrated ability to communicate highly technical security concepts to non-security audiences.
Ability to coordinate multiple teams in accomplishing process review and improvement.

Nice To Haves

AI fluency is preferred.
Web services security experience.
Additional professional certifications such as CSSLP or GCIH.

Responsibilities

Analyze, validate, communicate, and consult on security defects identified through automated and manual sources such as CodeQL, Rapid7 Web Application Security, penetration testing, and bug bounty programs, serving as a partner to software engineers who need accurate information on why a vulnerability exists and how to address it.
Serve as a trusted resource to software engineers, architects, product owners, and leaders, providing contextually-aware guidance to support sound decision-making, documenting decisions and resulting architectures, and navigating relevant review and approval processes when implementing new features or remediating existing issues.
Enable and monitor automated defect detection tooling (CodeQL, Rapid7, etc.) at the repository or application level according to established processes.
Collect and communicate required scope and access information for penetration testing and security assurance assessments, and manage the output of these assessments through the defect management process.