Senior Product Security Engineer

Verily•Boston, MA

10d

About The Position

Verily is seeking an exceptional information security engineer to support our Information Security and Privacy Risk Management function. The Information Security Engineer position combines a deep understanding of common information security technologies with a strong information security background. This individual will work closely with Verily’s Governance, Risk and Compliance team to ensure weekly/monthly/annual contractual compliance is established and maintained, especially as it relates to vulnerability management.

Requirements

BA/BS degree in Computer Science, Engineering, Management Information Systems.
5 years of experience in the Information Security or related domain(s).
3 years experience with NIST/FedRAMP compliance audits.
Strong knowledge of cloud security architecture, web application security, Vulnerability management, and security engineering.
Excellent written and verbal communication skills.
Qualified applicants must not require employer sponsored work authorization now or in the future for employment in the United States.

Nice To Haves

Experience with FedRAMP Moderate or higher.
Experience with GCP (preferred) or AWS, and also containerized environments (Kubernetes).
Experience with vulnerability management tools such as bug bounty programs, scanning and offensive security frameworks.

Responsibilities

Manage tools and inputs that are part of the Vulnerability Management program.
Track remediation tasks, engage with systems/services owners and stakeholders to ensure vulnerability management compliance.
Ensure that regulator weekly/monthly reports are provided for continual FedRAMP certifications and/or necessarily remediations (e.g., POA&M).
Apply prior understanding and experience of federal government compliance (e.g., FISMA, FedRAMP) to regularly report on process and operational readiness.
Keep abreast of new threats and vulnerabilities, and validate the risk of reported threats using vulnerability management, scanning and red team operations.