The Application Security team is an integral part of the Product Security Team at Teradata. We evangelize security at every phase of the software development life cycle, and work closely with developers to ensure applications are secure from inception through release. Given Teradata's large portfolio of analytic applications, we are pushing the boundaries of security by scaling threat modeling, source code analysis, and analytic security. Our expertise lies in deep technical understanding of security and are security educators within Teradata and the wider security community. The Application Security team is tasked with building advanced security tools and methods for automating security and are dedicated open source contributors.
Teradata is looking for someone who is passionate about security and understands the critical role security plays in the Software Development Life-cycle. The ideal candidate is passionate about moving security early in the SDLC and will work with development teams and architects to ensure design and implementation flaws are discovered before code is shipped. If you evangelize security and love to train developers to build better, more secure software, this position is for you.
Primary Job Responsibilities:
- Work with architects and developers to perform security risk analysis and threat model applications, services, and networks
- Contribute to architecture decisions to ensure a consistent approach to security
- Work with development teams to create and integrate attacker stories, abuse cases, and unit tests into their SDLC
- Serve as the security subject matter expert during architecture discussions
- Work with systems engineers to integrate security tools into continuous integration / continuous deployment pipelines
- Perform security risk analysis for products and portfolio and derive security requirements for new software solutions to help mitigate security vulnerabilities
- Research emerging and Teradata specific threats to enable hardening of products
- Develop best practices, and write whitepapers to standardize security practices in production workloads
- Interpret dynamic/static analysis tools results, and penetration test results and describe issues and fixes to non-security experts
- Provide vulnerability remediation guidance and mentoring to product development software engineers
- Contribute to and support efforts to build security products for the Teradata platform
- Develop proof of concept security applications for the Teradata platform
- Develop proof of concept applications to demonstrate best practices
- Be a leader in security by presenting security research at public conferences
- Provide security guidelines for the organization to protect critical assets and data
- Train developers in various aspects of security to include threat modeling, security reviews, and interpreting security findings
- Guide product development teams on automating security testing
- Evaluation of new technologies, tools, and/or development techniques that impact security
- Assist in the software security certification process for the organization
- Review, analyze, and evaluate both internally developed software and vendor products and procedures to address security requirements
- Work as part of a team.
- Excellent written and verbal communication skills are required.
- Ability to communicate effectively with business representatives in explaining security topics clearly and where necessary, in layman's terms.
- Candidates must be able to explain vulnerabilities and weaknesses in the OWASP Top 10, WASC, and CWE 25 to any audience, and discuss effective defensive techniques.
- Deep understanding of HTTP and SSL/TLS protocols, and Web applications
- Knowledge of networking fundamentals (all OSI layers)
- Knowledge of the Windows and *NIX operating systems
- Familiarity with Docker and Kubernetes
- Understanding of authentication protocols and frameworks to include OAuth, OpenID, and/or AWS IAM
- Familiarity with dynamic and static analysis tools
- Deep understanding of continuous integration / continuous deployment processes and tools
- Ability to interpret dynamic/static analysis tools, and penetration test results and describe issues and fixes to non-security experts
- Ability to automate tasks using a scripting language (Python, Perl, Ruby, etc).
- Ability to program in C, C++, C#, Objective C, Python, Java, PHP and/or ASM (x86)
- The ideal candidate has experience working with automation script languages such as Puppet, Chef, Cloud Formation, etc.
- Familiarity with common reconnaissance, exploitation, and post exploitation frameworks
- Demonstrated understanding of financial sector, or other large organization, security and IT infrastructures
- The ideal candidate has experience with cloud and virtualized technology in environments such as AWS, Azure and VMware
- Knowledge of current international best practices in privacy.
- MS/BS degree in Electrical Engineering, Computer Science, Information Technology, or related field. Advanced degree highly preferred