Cloud Security Engineer

Working as one team across geographies and functions We are fortunate to be led by a team of passionate, talented and experienced people who are committed to helping Axway customers succeed in the digital economy.

* The Cloud Security Engineer is a member of Product Security Group (PSG) in the R&D Department, a global group that focuses on the delivery of secure products that serve numerous industries worldwide. The Cloud Security Engineer performs technical activities that deliver effective Amazon Web Services (AWS) cloud, Axway application, and a combined Axway and AWS network security services for product teams and our customers. * This position, Cloud Security Engineer, will have primary responsibility for secure AWS deployments, validation of secured code, secure product deployment (by default), secure use of cryptographic libraries, secured web applications, optimizing and enhancing our use of industry leading security tools suites, and evangelizing the security development lifecycle (SDLC) at Axway. * This position will also have a role in performing vulnerability assessments, security penetration testing, and working with R&D development teams on remediation and mitigation of findings. This position will have a role on the Privacy and Security Incident Response Team (PSIRT) primarily for investigation and validating technical mitigations. The position may also provide security solutions to the OWASP open source community for projects that Axway participates in. * The Principle Security Cloud Security Engineer runs and monitors security tools which safeguard Axway products as applied through the Axway SDLC. The position also requires strong customer empathy, communication and negotiation skills with customers, Axway engineers, and the Axway management team.

Duties / Responsibilities: * Understanding of the Axway SDLC * Guide secure AWS architecture and secure AWS product deployments * Lead secure web applications delivery via industry leading AppSec practices * Lead, perform, and guide PEN testing (Fuzzing across internal product teams) * Assist Axway in incident handling and incident response for products and platforms * Support customers, development teams, and PSG in technical analysis of tool outputs * Support the management, control and upgrade of selected SDLC tool suites * Guide secure coding practices and processes as needed

Skills / Qualifications: * Technical skills, coupled with strong communication skills * Java, JVM, JCA/JCE experience, Crypto Library JDK’s * AWS architecture and secure AWS application deployments * C/C++ coding or analysis experience * Fortify static analysis tool experience * Nmap, Nessus, or other attack surface tool experience * Vulnerability scanning and mitigation * Dynamic code analysis tool usage * Sockets, TLS, SSL, and VPN experience * Layer 3 thru 7 network security experience * Penetration Testing and Fuzzing (files, functions) * Authentication and Authorization mechanics and protocols * Understanding and experience in IH/IR * System configuration, deployment, and technical control of infrastructure * Ability to learn new products and technical concepts quickly * Successfully manage time and technical responsibilities, set accurate expectations and meet deliverable deadlines while working in a team environment These essential functions are representative of those that must be met by an employee to successfully perform the job. Reasonable accommodations may be made to enable individuals with disabilities to perform these essential functions. Position may be required to perform other duties as required. Travel requirements may be up to 15% and include international travel destinations. Qualifications: * A minimum of 7 years of product development experience; at least 3 of those years focused on product security. * Must possess or obtain within 18 months from date of hire, industry recognized information security certifications, such as a CISSP, CSSLP or technical SANS certificates (GPEN, GWAPT), or Cloud Security Alliance CCSK certificate. * Hands-on experience in many of the following areas: AWS, C/C++, Java, Web Servers (Apache/IIS), Scripting languages, Penetration testing, Dynamic and Static analysis, Fuzzing, Vulnerability remediation techniques, Knowledge of the CVE, The OWASP top ten, the SANS top 25. * Experience using Microsoft Office suite tools to create documents, presentations, and detailed drawings. * Technical writing, documentation, and communication skills are required. Other sought after skills: * Comfortable working on both Linux-based and MS Windows-based system platforms with a strong technical understanding and aptitude for analytical problem-solving. * Strong understanding of enterprise, network, system and application level security issues. * Strong understanding of Cloud Computing and the AWS product suite * Understanding of enterprise computing environments, distributed applications, and a strong understanding of TCP/IP networks * Understanding of the system hardening processes, tools, guidelines and benchmarks. * Strong understanding of encryption technologies, Java/Linux and Microsoft implementations Education: * Bachelor’s degree in Computer Science, Information Technology or related field. Master’s preferred.