高级工程师 I，产品安全
Sr Engineer I, Product Security
职位描述：
高级产品安全工程师负责执行安全评估，实施安全最佳实践，并与产品团队合作，确保我们的产品符合最高的安全标准。
· 对产品功能和架构进行安全审查和威胁建模。
- 开发和维护用于产品开发的安全工具、指南和标准。
- 在软件开发生命周期中为产品团队提供安全指导和支持。
- 研究和评估新的安全技术和解决方案。
- 跟踪最新的安全趋势和威胁。
- 将安全工具集成到 CI/CD 流程中，并优化规则以减少误报。
- 编写脚本以自动化手动任务。
- 执行其他支持该职位总体目标的职责。
所需教育背景：
· 计算机科学、工程或相关领域的学士学位。
- 或者，任何教育和经验的组合，能够提供该职位所需的资格。
所需经验：
· 5 年以上产品安全、应用安全或软件工程方面的经验。
- 具有安全工具和框架（如 OWASP、NIST 等）的经验。
- 具有安全测试方法和工具（如静态分析、动态分析、渗透测试等）的经验。
知识、技能与能力：
· 知识：对 Web 和移动安全、云安全、密码学和网络安全有深入了解。熟练掌握安全技术、框架、安全测试方法和工具。至少掌握一种编程语言（如 Python、Java、C# 等）。
- 技能：优秀的沟通、人际交往和协作能力。具备问题解决和分析能力。
- 能力：能够快速识别、排查并解决问题，运用合理的判断力、冷静和外交手段。能够在独立工作和团队合作中胜任。
公司已审核此职位描述，以确保包含关键职能和基本职责。该描述旨在为职位期望和员工履行该职位的能力提供指导。它不构成对该职位所有职能、责任、技能和能力的详尽列表。主管可根据需要适当分配其他职能和要求。本文件不代表雇佣合同。
查看英文原文
Job Description:
The Sr. Engineer I, Product Security is responsible for conducting security assessments, implementing security best practices, and collaborating with product teams to ensure that our products meet the highest security standards.
· Perform security reviews and threat modeling of product features and architectures.
- Develop and maintain security tooling, guidelines, and standards for product development.
- Provide security guidance and support to product teams throughout the software development lifecycle.
- Research and evaluate new security technologies and solutions.
- Stay up to date with the latest security trends and threats.
- Integrate security tools into CI/CD and finetune rules to reduce false positives.
- Write scripts to automate manual tasks.
- Perform other duties that support the overall objective of the position.
Education Required:
- Bachelor's degree in computer science, Engineering, or related field.
- Or, any combination of education and experience which would provide the required qualifications for the position.
Experience Required:
- 5+ years of experience in product security, application security, or software engineering.
- Experience with security tools and frameworks (e.g., OWASP, NIST, etc.).
- Experience with security testing methodologies and tools (e.g., static analysis, dynamic analysis, penetration testing, etc.).
Knowledge, Skills & Abilities:
- Knowledge of: Strong knowledge of web and mobile security, cloud security, cryptography, and network security. Proficiency in security technology, frameworks, security testing methodologies and tools. Proficient in at least one programming language (e.g., Python, Java, C#, etc.).
- Skill in: Excellent communication, interpersonal, and collaboration skills. Problem solving, analytical skills.
- Ability to: Identify, troubleshoot and resolve problems quickly using sound judgment, poise and diplomacy. Ability to work independently and as part of a team.
The company has reviewed this job description to ensure that essential functions and basic duties have been included. It is intended to provide guidelines for job expectations and the employee's ability to perform the position described. It is not intended to be construed as an exhaustive list of all functions, responsibilities, skills and abilities. Additional functions and requirements may be assigned by supervisors as deemed appropriate. This document does not represent a contract of employment, and the company reserves the right to change this job description and/or assign tasks for the employee to perform, as the company may deem appropriate.
NextGen Healthcare is an equal opportunity employer. We celebrate diversity and are committed to creating an inclusive environment for all employees.
Originally posted on Himalayas