Staff Security Engineer - AppSec

Job Title

Staff Security Engineer, AppSec

Organizational Reporting

Manager, Security Engineering

Function/Dept

Business Technology / Security

Purpose of the Job

As members of 6sense’s Security department, the Security Engineering team protects the platform. Application Security Engineers work closely with engineering teams, product managers (PM), and third-party entities to ensure that 6sense SaaS products are secure.

JOB DESCRIPTION

Responsibilities & Accountabilities

Serve as mentor to other Security Engineers, providing guidance and support

Ability and willingness to assist with Senior level responsibilities if needed

Support and consult with engineering and product teams around application security vulnerabilities.

Assist teams in reproducing, triaging, and addressing application security vulnerabilities identified through Pen Testing, SAST, DAST, or Dependency scans

Take initiative and drive changes in our bug bounty program which position us as an industry leading security program

Lead in development of automated security testing to validate that secure coding best practices are being used

Lead application security reviews and threat modeling, including code review and dynamic testing

Lead and influence cross-functional changes across the Security organization

Have significant ownership in and evangelize security training with development teams

Drive initiatives which scale application security and holistically address multiple vulnerabilities found in a functional area

Design and execute quarterly (O)KRs

Performance Measurement

Understands the 6sense product and platform at an expert level

Takes initiative to identify gaps and drive change to improve the security posture

Participates in weekly 1:1s with manager and monthly skip levels

Implements security controls considering the latest security threats, trends, and best practices to ensure that 6sense's security posture remains effective and efficient

Manages vulnerabilities to remediation within targeted SLA or risk acceptance

Maintains inventory of security scope for 6sense product(s)

Maintains up to date collateral, metrics and processes

PERSON SPECIFICATION

Educational and Experience Requirements

8+ years of experience in information security, with a focus on all aspects of application security, including threat modeling, developer training, vulnerability management, automated security testing, and code reviews.

Expert understanding and ability to explain common security flaws and ways to remediate them (e.g. OWASP Top 10)

Expert level of understanding of network and web related protocols (such as TCP/IP, UDP, HTTP, HTTPS protocols)

Some development or scripting experience and skills in Python or JavaScript

Excellent communication skills (written and verbal) with an ability to articulate complex topics in a clear and concise manner

Experience working directly with software developers to improve code security

Expert understanding and practical experience with common security libraries, security controls, and common security flaws

Experience with security tools (e.g., Vulnerability Scanners, SAST/DAST, DevOps software, AWS cloud security tooling)

Strong knowledge of industry frameworks, regulations and standards, such as: NIST 800-218 SSDF, OWASP, SAFECode, CIS benchmarks, ISO 27001, SOC 2, GDPR, PCI, SOX, NIST 800-53, etc.

Preferred Qualifications

Bachelor's degree in a related field

Relevant industry certifications, such as AWS, CNCF, and GIAC are highly desirable

Competencies and Behaviors

Exceptional communication skills, including verbal, written, and presentation skills, and ability to appropriately address audience in communications

Works independently and manage multiple projects simultaneously

Influences and collaborates with cross-functional teams

Translates technical requirements into actionable and timebound requests

Drives projects and tasks to completion by following up on questions, deadlines, and requests for input

Maintains accuracy of information

Rapid and effective prioritization and escalation

Base Salary Range: $200,946.75 - $255,721.90. The base salary range represents the anticipated low and high end of the base salary range for this position. Actual salaries may vary and may be above or below the range based on various factors, including but not limited to work location and experience. The base salary is one component of 6sense’s total compensation package for this position. Other compensation may include a bonus program or commission plan, and stock options if approved by 6sense’s board. In addition, 6sense provides a variety of benefits, including generous health insurance coverage, life, and disability insurance, a 401K employer matching program, paid holidays, self-care days, and paid time off (PTO). #Li-remote

Notice of Collection and Use of Personal Information for California Residents: California Recruitment Privacy Notice and Policy