Senior Cybersecurity Engineer, Applications

POSITION SUMMARY:

This position is a member of the cybersecurity team responsible for improving the cybersecurity posture across the organization. The principal focus of this position is application security, bringing depth in securing software, applications, and the environments in which they are built and deployed. The incumbent also contributes across the broader cybersecurity program and is responsible for maintaining knowledge of current trends in the industry.

DUTIES AND RESPONSIBILITIES: 

• Analyze, investigate, respond to, and recover from cybersecurity incidents, events, and threats as per the incident response lifecycle.

• Remediate application vulnerabilities and guide engineering/development teams to take preventative measures.

• Integrate security into the software development lifecycle, including static analysis, dynamic analysis, and software composition analysis within build and deployment pipelines.

• Conduct threat modeling and secure design reviews for new and existing applications, and provide security recommendations to development and architecture teams.

• Represent security in architecture design reviews and the Change Advisory Board to ensure security considerations are addressed before changes are approved.

• Assess and improve the security of application hosting environments, including AWS workloads and containerized platforms.

• Coordinate external application penetration testing and manage findings through remediation.

• Engineer security solutions to mitigate risk and improve the security posture of MSD.

• Assist with the development and maintenance of security tools, techniques, and procedures to facilitate security testing, vulnerability detection, validation, and mitigation.

• Understand and evaluate best practices against COTS (Commercial Off-The-Shelf) application as well as custom developed applications.

• Assist with the evaluation and assessment of different security technologies to appropriately expand MSD’s cybersecurity portfolio.

• Stay abreast of relevant Application Security and Cloud related industry updates and changes via conferences, training and events.

• Assist with the continuous improvement of security posture and provide hands-on cybersecurity support to address Cybersecurity issues as needed.

• Collect, report and continually enhance security metrics.

• Continually monitor and maintain an understanding of the security posture of application development tools, technologies and libraries.

EXPERIENCE AND QUALIFICATIONS:

• Bachelor's degree in MIS, computer science, computer engineering or related field with a concentration in cybersecurity, or an equivalent combination of education and relevant experience.  

• Minimum of 5 years of relevant work experience in cybersecurity, including demonstrated depth in application or software security. Broader experience across other cybersecurity disciplines is valued, as this position contributes to the wider security program.

• Life sciences experience is a plus.

• Experience working in regulated or validated environments is strongly desired.

• Industry certification such as GWAPT, GWEB, OSWE, CSSLP, OSCP, or CISSP is a plus.

KNOWLEDGE, SKILLS AND ABILITIES:

• Knowledge of secure coding best practices and frameworks, and of software supply chain risk including dependency management and artifact repository controls.

• Working knowledge of OWASP resources, including the Top 10 and Application Security Verification Standard, and hands-on experience with static analysis, dynamic analysis, and software composition analysis tooling.

• Experience securing applications built on Java or .NET stacks. Familiarity with the development practices and common weaknesses of at least one is required.

• Knowledge of API security and of authentication and authorization technologies including SSO, OAuth, OIDC, and SAML, and of session management practices.

• Working knowledge of Amazon Web Services and cloud security controls for application workloads, including container and Kubernetes security.

• Knowledge of network, web server, and database security, including web application firewall concepts, along with malware analysis and incident response.

• Familiarity with security standards, access controls, and compliance requirements based on industry standards. Experience with one or more of the following is preferred: ISO 27001, NIST Cybersecurity Framework.

• Understanding of data security including classification, encryption, DLP, and secrets management for credentials in code and pipelines.

• Ability to create, maintain, and report metrics that measure the effectiveness of security controls.

• Scripting and automation skills in Bash, Python, PowerShell, or similar is a plus.

• Self-starter who takes ownership of security initiatives and drives them to completion with minimal supervision. Hands-on in approach and collaborative across teams.

• Effective communicator with a positive and confident attitude.

• Excellent writing skills with the capability to create well-formatted reports and customer-facing documentation.

PHYSICAL DEMANDS:

While performing the duties of this job, the individual is frequently required to sit and stand for long periods. The individual is occasionally required to walk; use hands and fingers to operate, handle, or feel objects, tools, or controls; reach with hands and arms. 

WORK ENVIRONMENT:

This position is performed in a traditional office environment with an option for occasional telework.  Occasional local travel among offices as needed.

MSD is an Equal Opportunity/Affirmative Action Employer. We are committed to fostering a diverse and inclusive workplace where all individuals are treated with respect and dignity. We welcome applications from all qualified candidates, making employment decisions without regard to race, color, religion, creed, sex, sexual orientation, gender identity, genetic information, marital status, national origin, age, protected veteran status, pregnancy, disability status, or any other protected characteristic. For our full EEO/AA and Pay Transparency statement, please visit here. Meso Scale Diagnostics uses E-Verify to validate the work eligibility of candidates.