Principal Product Security Engineer

iManage•Chicago, IL

4d•$165,000 - $205,000•Hybrid

About The Position

The Principal Product Security Engineer joins iManage’s product security team to guide global engineering teams on security considerations, assess and improve product security, and maintain and mature the company’s Zero-Trust architecture. The role focuses on helping engineers ship secure code and infrastructure while applying industry security practices across threat modeling, architecture review, dynamic and static code reviews, cloud and data security assessments, runtime and event security, compliance, and red, blue, and purple team activities. The engineer works independently and collaboratively with a global team to continually improve security and deliver hardened enterprise solutions. The role also supports security improvement across the software development lifecycle, monitors emerging threats and compliance changes, advises management on risk mitigation, develops and communicates training, mentors colleagues, and communicates application and deployment security posture internally and to customers.

Requirements

Bachelor’s degree or higher in computer science or a related field.
7–10+ years of relevant work experience.
Extensive experience assessing risk and providing remediation guidance for vulnerabilities in one or more of these areas: SAST, SCA, DAST, host/container security, IaC, platform security, manual penetration testing, cloud configuration, network security, data security, API security, and CI/CD processes.
Extensive experience with best practices, metrics, and mechanisms for improving security testing methodologies.
Proven experience and understanding of multi-tier web application architecture patterns.
Extensive experience with software development practices, tooling, and technologies.
Curiosity and a desire to improve customer experience, reduce risk, improve methods, and prepare for new threats.
Ability and desire to communicate with colleagues to plan and implement continual improvement through industry best practices, threat modeling, and vulnerability triage.
In-depth understanding of OWASP Top 10 risks, including injection, XSS, and CSRF.
Understanding of data classification and data security control implementations.
Extensive experience with common cloud security controls and best practices.
Experience measuring software security programs using BSIMM, SAMM, and ASVS frameworks.

Responsibilities

Create best practices, metrics, and mechanisms to improve security testing methodologies within the SDLC.
Analyze emerging trends, news, and changes in the threat and compliance environment in relation to organizational risk.
Advise management while developing and executing plans for compliance and risk mitigation.
Develop and communicate security training material for engineering teams and security champions.
Mentor team members, continue learning and improving, and share knowledge with colleagues.
Communicate the security posture of applications and deployment environments internally and externally to customers.
Guide global engineering teams on security considerations and assess and improve product security.
Contribute to the continued maintenance and maturity of the Zero-Trust architecture.
Apply security practices such as threat modeling, architecture review, code review, cloud and data security assessments, runtime and event security, compliance, and red, blue, and purple team activities.

Benefits

Annual performance-based bonus.
Health, vision, dental, and life insurance.
401(k) retirement savings plan with company match up to 4%.
Enhanced parental leave: 20 weeks of fully paid primary leave and 10 weeks of fully paid secondary leave.
Flexible time-off policy.
Company wellness days.
Access to RethinkCare behavioral health resources.
Unlimited access to LinkedIn Learning courses and interactive Microsoft courses and training.
Modern open-plan workspace with a gaming area, free snacks and drinks, and regular social events.
Flexible work hours.