Senior Cybersecurity Engineer, Applications

MSD Careers•Rockville, MD

3d•Onsite

About The Position

This position is part of the cybersecurity team and focuses primarily on application security, helping improve the organization’s cybersecurity posture by securing software, applications, and the environments in which they are built and deployed. The role also contributes to the wider cybersecurity program and requires keeping current with industry trends. The incumbent responds to cybersecurity incidents and threats, remediates application vulnerabilities, integrates security practices and testing into software development and deployment, and advises engineering, development, and architecture teams. The position assesses application hosting environments, including AWS and containerized platforms, coordinates external application penetration tests, helps develop security tools and procedures, evaluates security technologies, and reports security metrics. The role is based in a traditional office environment, with occasional telework and local travel among offices as needed.

Requirements

Bachelor’s degree in MIS, computer science, computer engineering, or a related field with a concentration in cybersecurity, or an equivalent combination of education and relevant experience.
At least 5 years of relevant cybersecurity work experience, including demonstrated depth in application or software security.
Knowledge of secure coding best practices and frameworks, software supply chain risk, dependency management, and artifact repository controls.
Working knowledge of OWASP resources, including the Top 10 and Application Security Verification Standard, and hands-on experience with static analysis, dynamic analysis, and software composition analysis tools.
Experience securing applications built on Java or .NET; familiarity with development practices and common weaknesses of at least one is required.
Knowledge of API security, SSO, OAuth, OIDC, SAML, authentication and authorization technologies, and session management practices.
Working knowledge of AWS and cloud security controls for application workloads, including container and Kubernetes security.
Knowledge of network, web server, and database security, including web application firewall concepts, as well as malware analysis and incident response.
Familiarity with security standards, access controls, and industry-based compliance requirements.
Understanding of data security, including classification, encryption, DLP, and secrets management for credentials in code and pipelines.
Ability to create, maintain, and report metrics that measure security-control effectiveness.
Self-starter who takes ownership of security initiatives and drives them to completion with minimal supervision.
Hands-on and collaborative approach across teams.
Effective communication skills and a positive, confident attitude.
Excellent writing skills, including the ability to create well-formatted reports and customer-facing documentation.

Nice To Haves

Life sciences experience.
Experience working in regulated or validated environments.
Industry certification such as GWAPT, GWEB, OSWE, CSSLP, OSCP, or CISSP.
Experience with ISO 27001 or the NIST Cybersecurity Framework.
Scripting and automation skills in Bash, Python, PowerShell, or similar.

Responsibilities

Analyze, investigate, respond to, and recover from cybersecurity incidents, events, and threats according to the incident response lifecycle.
Remediate application vulnerabilities and guide engineering and development teams in preventative measures.
Integrate security into the software development lifecycle, including static analysis, dynamic analysis, and software composition analysis in build and deployment pipelines.
Conduct threat modeling and secure design reviews for new and existing applications, and provide recommendations to development and architecture teams.
Represent security in architecture design reviews and the Change Advisory Board.
Assess and improve the security of application hosting environments, including AWS workloads and containerized platforms.
Coordinate external application penetration testing and manage findings through remediation.
Engineer security solutions to mitigate risk and improve MSD’s security posture.
Help develop and maintain security tools, techniques, and procedures for security testing, vulnerability detection, validation, and mitigation.
Evaluate best practices for commercial off-the-shelf and custom-developed applications.
Help assess security technologies to expand MSD’s cybersecurity portfolio.
Keep current with Application Security and Cloud industry updates through conferences, training, and events.
Support continuous security posture improvement and provide hands-on cybersecurity assistance as needed.
Collect, report, and continually improve security metrics.
Monitor and maintain an understanding of the security posture of application development tools, technologies, and libraries.