Senior Cyber Risk Management Engineer

Delta Dental • Oakland, CA

4d • Onsite

About The Position

Delta Dental of California is seeking a Senior Cyber Risk Management Engineer to maintain a comprehensive understanding of information security principles and enforce the proper use of security technologies across the organization. This role will oversee cloud security management and design cloud security controls for various cloud offerings (SaaS, PaaS, IaaS). The engineer will be responsible for securing in-house developed applications and APIs, applying OWASP Top 10 API security principles, and utilizing contemporary security theories and practices such as vulnerability assessment, threat modeling, and secure design concepts. The position involves leading and managing multifunctional projects throughout the systems development lifecycle, ensuring security is integrated at every stage. The candidate must live within a reasonable commuting distance from HQ and be able to appear in the office as required.

Requirements

• Master’s degree or foreign degree equivalent in Computer Science or related field and five (5) years of experience in Information Security related role or job offered.
• Design and implement secure architectures from inception, including the development of comprehensive end-to-end security design blueprints for enterprise systems, while providing expert guidance to developers, infrastructure SMEs, and stakeholders on implementing necessary controls.
• Address Identity and Access Management (IAM) requirements, such as integrating SSO, MFA, RBAC, and enforcing least-privilege principles across enterprise platforms.
• Demonstrate strong experience with Entra ID, including risk-based authentication and identity lifecycle management within Azure Entra ID.
• Design and validate infrastructure security controls, encompassing network segmentation, configuration of firewalls (Palo Alto, Cisco), deployment of intrusion prevention systems (Cisco Firepower), endpoint protection solutions (CrowdStrike), and zero-trust networking.
• Possess proficiency in applying segmentation strategies within cloud environments using technologies like NSGs, cloud firewalls, and Azure Front Door.
• Implement robust cloud security controls across diverse platforms, including Azure and Oracle Cloud, with competencies in encryption, workload protection, and cloud-native security services.
• Capable of designing secure integrations between public clouds and on-premises deployments.
• Apply application security best practices, including secure coding standards, static and dynamic application testing (SAST/DAST), integration into the secure SDLC, and API security, ensuring compliance with the OWASP Top 10 security requirements.
• Review code scan reports generated by tools such as Fortify and Black Duck, providing remediation guidance and issue resolution recommendations to development teams.
• Define and prescribe security requirements for a broad range of implementations, including COTS applications, custom-developed software, SaaS, and platform services, ensuring alignment with corporate and regulatory standards.
• Engineer security designs and controls for enterprise platforms such as Pega, Salesforce, and Snowflake, with a focus on data protection, access governance, and regulatory compliance on those platforms.
• Perform threat modeling utilizing multiple frameworks (e.g., STRIDE, PASTA, MITRE ATT&CK, MITRE ATLAS), integrating outcomes into system design to proactively mitigate identified risks.
• Conduct detailed risk assessments and analyses, mapping results to NIST, HIPAA, PCI DSS, and ISO/IEC 27001 standards to inform strategic business decisions and risk mitigation plans.
• Collaborate with cross-functional teams to develop security patterns, standards, and reusable controls, facilitating scalable and consistent security adoption throughout the enterprise.

Responsibilities

• Maintain a comprehensive understanding of information security principles and enforce the proper use of security technologies across the organization.
• Oversee cloud security management and design cloud security controls to secure the deployment in different cloud offerings, including SaaS, PaaS, and IaaS.
• Secure in-house developed applications and APIs, applying OWASP 10 API security principles including but not limited to fine-grained authorization and access control measures.
• Apply contemporary security theories and practices, including vulnerability assessment, exploitation techniques, threat modeling, attack vector analysis, and secure design concepts to strengthen defenses.
• Lead and manage multifunctional projects or initiatives throughout the systems development lifecycle, ensuring security is integrated at every stage.

What This Job Offers

• Job Type: Full-time
• Career Level: Senior