Associate Security Engineer Job in Bangalore at Goldman Sachs

Goldman Sachs is hiring for the role of Associate Security Engineer!

Responsibilities of the Candidate:

• Lead and/or support static, dynamic and security awareness services.
• Drive adoption of application security controls within Software Development Life Cycle (SDLC).
• Review issues identified by S-SDLC tools, ensuring compliance to established review SLAs.
• Interface with Business Units, provide advice and consultation, to help remediate issues identified by S-SDLC tools.
• Develop, and customise rules, to improve detection capability of S-SDLC tools. 
• Help engineer tools and solutions that facilitate the adoption of security controls.
• Develop Proof-of-Concepts (PoC), to be shown as solutions, and handover to Engineering for broader rollout.
• Work with engineers to develop customized security testing strategy to complement the existing security testing program managed by Technology Risk.
• Be responsible to communicate program to broader developers’ community for solutions that might impact Developer Experience (DevEx).
• Be responsible for the awareness, training and guidance on security related issues.
• Conduct product evaluation of solutions that may benefit the S-SDLC program.

Requirements:

• Ability to explain common secure coding practices and application security vulnerabilities, based on guidance from the industry recognised cybersecurity frameworks and standards e.g. NIST Cyber Security Framework and OWASP.
• Ability to engage technical client base of engineers and communicate security requirements, potential risks, and influence development practices.
• Ability to communicate security flaws in a clear and concise manner to a broad range of audience from engineers, SMEs to senior management and provide clear remediation guidance.
• Experience with software development methodologies e.g. Agile, DevOps etc.
• Fluent in at least one major programming language (e.g. Java, Python, Go etc.)
• Working knowledge of CI/CD platforms e.g. Gitlab, AWS Code Commit and Deploy (or similar).
• Intermediate Knowledge of DevSecOps solutions i.e. ability to review identified findings, conduct analysis (e.g. impact, accuracy etc.), develop and customise detection capability of one or more of the following solutions:
  • Static Application Security Testing (SAST)
  • Dynamic/Interactive Application Security Testing (DAST/IAST)
  • Software Composition Analysis (SCA)
  • Infrastructure as Code (IaC)
  • Container Security
  • Mobile Security