Key Responsibilities
Security Engineering & Architecture
- Design, implement, and maintain enterprise security controls across cloud, infrastructure, and application environments.
- Evaluate emerging threats and technologies and recommend improvements to the organization's security architecture.
- Develop security standards, engineering patterns, and technical guidance to improve the overall security posture.
Security Automation & DevSecOps
- Design and develop security automation solutions that improve operational efficiency and reduce manual effort.
- Integrate security controls and validation activities into CI/CD pipelines and software delivery workflows.
- Build and maintain GitHub Actions and related automation to support secure development practices.
- Automate vulnerability management, policy enforcement, reporting, and remediation tracking activities.
Application Security
- Lead security engineering efforts focused on protecting internally developed applications and APIs.
- Perform and coordinate:
- Threat modeling
- Secure design and architecture reviews
- Secure code reviews
- Static Application Security Testing (SAST)
- Dynamic Application Security Testing (DAST)
- Software Composition Analysis (SCA)
- Open-source dependency and supply chain security reviews
- Secret and credential exposure detection
- API security testing and assessments
- CI/CD pipeline security reviews
- Security validation of application deployments
- Partner with development teams to identify, prioritize, and remediate security risks.
Web Application Firewall (WAF) & Edge Security
- Design, implement, and maintain Web Application Firewall (WAF) capabilities.
- Develop and tune security rules, attack detection logic, bot mitigation, rate limiting, and application-layer protections.
- Continuously monitor and improve protections against OWASP Top 10 and emerging web application threats.
Offensive Security & Penetration Testing
- Conduct application red team exercises and adversarial security assessments.
- Perform manual and automated penetration testing of web applications, APIs, and supporting services.
- Simulate real-world attack techniques to identify weaknesses in application design, authentication, authorization, and deployment architectures.
- Document findings, provide remediation guidance, and validate corrective actions.
Collaboration & Security Operations Support
- Partner with engineering, infrastructure, and cloud teams to implement secure solutions.
- Support incident response investigations involving applications, cloud services, and development platforms.
- Provide technical leadership and mentorship on security engineering practices and security tool adoption.
Success Measures
- Increased automation and efficiency of security processes.
- Successful integration of security controls into engineering and CI/CD workflows.
- Reduction of application and cloud security risks.
- Effective implementation and management of WAF protections.
- Timely identification and remediation of vulnerabilities.
- Successful execution of penetration testing and red team activities.
- Improved security posture across applications, APIs, and software delivery platforms.
Originally posted on