9+ years of hands-on experience in product security, focusing on C/C++ development and security analysis.
Full-time degree in Engineering, preferably in Computer Science.
Expertise in at least one security area: Unix System, Network, or Cryptography.
Strong low-level Linux systems knowledge and hands-on experience in C and C++ programming.
Good understanding of Networking protocols like TCP/IP, HTTP/S, and DNS.
Proficient in debugging tools like GDB and core dump analysis.
Extensive knowledge of common vulnerabilities, particularly the OWASP Top 10.
Responsibilities
Lead and execute the Secure Software Development Lifecycle (SSDLC) for On-Prem and Cloud products.
Provide security guidance to product development teams on design changes.
Conduct manual source code reviews primarily in C and C++.
Perform crash exploitability analysis to identify security vulnerabilities.
Execute internal penetration tests to uncover security weaknesses.
Identify and develop prototypes to prevent security issues at scale.
Benefits
Access to healthcare, life insurance, and disability benefits.
401(k) plan with company match.
Opportunities for annual bonuses and sales incentives.
Full Job Description
About This Team: As a Lead Product Security Engineer, you will work hands-on in product security alongside top engineering talent to solve complex security challenges.
Duties and Responsibilities
You will be responsible for leading and executing the Secure Software Development Lifecycle (SSDLC) for Cloud Software Group On-Prem and Cloud products to ensure that our software meets the customer expectation of security robustness.
You will provide guidance to product development teams on design changes as per security requirements.
Manual Source Code Review primarily C and C++ programming languages
Crash Exploitability Analysis - Analyze Crashes to Find Security Vulnerabilities using tools such as gdb (Good to have)
Execute the penetration tests internally to identify security vulnerabilities
Identify opportunities to prevent security problems at scale, Develop prototypes to prevent these security problems.
Basic Qualifications
9+ years of hands-on experience in product security, with a strong emphasis on C/C++ development and security analysis
You have a Full-time degree in Engineering (Preferably Computer Science related)
You are an expert in at least one of these areas in security - Unix System, Network, Cryptography
Demonstrated hands-on experience in C and C++ programming, with strong low-level Linux systems knowledge.
Good knowledge of Networking (TCP/IP) and other protocols like HTTP/S, DNS, et.al.
Debugging Skills like GDB, core dump analysis and understanding Makefile concepts.
Extensive knowledge of common vulnerabilities - able to explain and remediate the OWASP Top 10 vulnerabilities across multiple programming languages
Reverse Engineering (Good to have)
Fuzzing using tools such as AFL, Peach (Good to have)
Deep understanding of application architecture and design principles
Experience in design review and threat modelling activities
You are capable of writing exploits for vulnerabilities identified in those respective areas.
Have excellent capabilities to identify security vulnerabilities and perform root cause analysis.
Good to have certifications such as OSCP, OSCE, GPEN, CRTP etc.
Compensation may vary depending on your location, qualifications including job-related education, training, experience, licensure, and certification, that could result at a level outside of these ranges. Certain roles are eligible for additional rewards, including annual bonus, and sales incentives depending on the terms of the applicable plan and role as well as individual performance.CA generally ranges: $191,520-$287,280All other locations fall under our General State range: $168,000-$252,000Benefits may vary depending on the nature of your employment with Cloud Software Group and the country where you work. U.S. based employees are typically offered access to healthcare, life insurance and disability benefits, 401(k) plan and company match, among others. This requisition has no specific deadline for completion.
