Principal Product Security Engineer

Aspen Technology • Bedford, MA

76d

About The Position

AspenTech is an AI-powered software company helping the world's leading energy, chemical and engineering companies succeed in their digital transformation, making their operations more efficient and reducing impact on the environment. At AspenTech, you will be part of a global market-leading company with double digit growth and a blue-chip customer base. We offer the opportunity to make an impact, to drive innovation and to be an agent of positive change. Our culture and vision have taken dramatic leaps forward over the past two years and we still have work to do. We need extraordinary individuals to pave the way ahead. Under the direction of the VP of Product Security, this role is a key member for day-to-day operations of Product Security at Aspen Technology. This role will help protect our clients, enable teams to deliver secure development, and position us for future security needs. This thought leader will help drive mitigation of risk through activities such as developing Threat Models, driving Risk Assessments, reviewing alignment of standard controls to mitigate risks in products, oversee vulnerability tracking, ensure security documentation and compliance with security lifecycle activities for product security releases.

Requirements

• Bachelor's degree (B.A./B.S.) or equivalent in computer science or technical equivalent discipline from an accredited college or university required.
• 8+ years of experience in IT required.
• 5+ years of experience in an information security role or experience with security and development teams.
• Knowledge of information security regulatory requirements for privacy, secure by design, and defense in depth.
• Maintains broad understanding of information security including ISO27002, NIST and other information security frameworks and regulations.
• Experience with Application/Product Security, Risk Assessment, Threat Models, Secure Architecture/Design, Security Scanning.
• Experience with cloud solutions such as Azure and AWS.
• Demonstrated ability to plan, design, develop, deploy, and maintain application security best practices.
• Ability to assume high levels of responsibility and to work with a minimum of day-to-day supervision.
• Ability to cooperatively and effectively work with people from all organizational levels and build consensus through negotiation and diplomacy.

Nice To Haves

• Preferable exposure to IEC 62443-4-1, IEC 62443-4-2, NIST 800-53, ISO 27001, ISO 27002, Cloud Security Alliance (CSA), Cybersecurity and Infrastructure Security Agency (CISA), SANS, OWASP, CWE 25, ethical hacking, and AI Security best practices.
• Desired domain knowledge and/or certification: CISSP, CISA, CCSP, CSSLP, CEH, SANS GIAC, security certification from AWS or Azure.
• Desired knowledge of the following Technologies: Static Application Security Testing (SAST), Dynamic Application Security Testing (DAST), Software Composition Analysis (SCA).
• Experience with Application Security Best Practices such as web security, cloud security, pen testing, fuzz testing, security coding guidelines, security architecture/design principles, CVSS, STRIDE, DREAD.
• Experience with Application development technologies, processes, and best practices. For example: Agile, RUP, CICD, DevSecOps.

Responsibilities

• Responsible for supporting the design, implementation, and oversight of Product Secure Development Lifecycle.
• Administers product security practices to product teams, technology, and security champions across the organization.
• Drive Product Security efforts to resolve challenges, enable automation, and impact organization security culture.
• Monitors information security best practices, standards, regulations, industry threats and risks for improvements to product security practices.
• Maintains a deep understanding of current issues in the realm of information security.
• Monitors security bulletins and alerts from all Aspen Technology's information system vendors.
• Evaluates vulnerability impact and formulates and executes risk mitigation plans for product security.
• Member of the AspenTech Security Emergency Response Team (ASERT) providing expert analysis of security customer reported security incidents.
• Works with information resource owners during and after security incidents; work with product teams for analysis; recommends best practices and solutions.
• Occasionally after hours and weekend work to perform tasks that cannot be done during business hours.

What This Job Offers

• Job Type: Full-time
• Career Level: Senior
• Industry: Professional, Scientific, and Technical Services
• Education Level: Bachelor's degree