Product Security DevOps Architect

Deltek, Inc. - Remote3.9

Full-timeEstimated: $140,000 - $180,000 a year
EducationSkills
Role
Deltek is seeking a highly motivated Product Security Architect with a passion for security, code, DevOps, and modern infrastructure. In this role, you’re a key member of the team driving Deltek’s evolution to secure-by-design via our Agile development process, working with Developers and Product Managers through a risk-based approach across our portfolio of products. Deltek’s product stacks are innovative, integrating security into how we build, deploy, and operate.

This position requires the ability to architect, collaborate, influence, develop, and clearly communicate across all levels of Deltek’s Product and Operations Teams. This is an opportunity for a proven DevSecOps engineer to leverage their expertise and make our software and cloud services more resilient to threats while also driving security forward as our products migrate ground-to-cloud. With multiple teams of developers spanning a spectrum of products, you’ll fluidly adapt to changing priorities, situations, across our software and cloud solutions.

Responsibilities
Architect product security designs and technology, based upon security standards, appsec assessments and Deltek requirements into actionable stories delivered through product roadmaps and backlog. You’ll layer security into our SDLC, shifting left, advising product teams on how to incorporate security into their coding and testing, and changing the mindset through education and Developer training. You’re the security subject matter expert and see opportunities to bring security into Deltek product roadmaps.

This position will directly advise Deltek Developers to remediate security bugs at the code level, design new security features, and strategically address how to unify Deltek’s product experience, reducing complexity and risk along the way. Effective communications are critical to success in this role, you should be adept at delivering the right message to audiences of all levels, and able to translate complex technical security matters into business terms.

This position requires the candidate to have experience coding in one of the following languages: Java/J2EE, .Net, JavaScript, and have scripting abilities in Python, PowerShell and others.
Be the technical security architect, leading technical security initiatives across all of Deltek’s products and cloud services.
Define policies and baselines for automated code scanning tools: Checkmarx and Veracode. Integrate the code scanning capabilities with TFS to create and execute CI/CD throughout our product line.
Deltek strives to build software according to the OWASP Top 10 standard and platforms according to CIS controls. You’re able to distill these frameworks to the code and infrastructure levels, bringing Developers and Product Managers along.
Conduct code reviews of applications to assess security flaws and provide explicit code-level feedback on how to remediate. Be the leader-teacher and educate Developers on security risks in order to scale security knowledge across our Developers.
Work collaboratively with Ops Teams to integrate continuous security into automation and monitoring to enable quick builds into parallel environments.
As part of ground-to-cloud evolution, work with developers to implement secure design and requirements around cloud native applications using Infrastructure as code, DevSecOps pipeline
Strategically define security standards and requirements for leading edge technology integrations such as: OCR, RPA, ML, NLP and others.
Develop and maintain a security architecture for products and cloud environments that is clearly aligned with Deltek business, technology and threat drivers.
Conduct threat modeling of Deltek services and applications that tie to the risk and data associated with offerings

Qualifications

Qualifications
Requires 8 years with BS or 6 years with MS in Computer Science, Technology, Engineering, Math or related field and 5+ years of prior relevant software engineering or DevOps experience.
One or more of the following certifications: CISSP, CSSLP, AWS Solutions Architect.
Verifiable experience reviewing application code for security vulnerabilities.
Full-stack knowledge of IT infrastructure: Applications, Databases, Operating systems (Windows and Linux).
Direct experience designing IAM technologies and services: Active Directory, LDAP, AWS IAM. Authorization & authentication standards such as: SAML, OAuth, Webauthn, FIDO, SSO, ADFS.
Experience with CI/CD tools such as: Jenkins, TeamCity, Octopus, Puppet, TFS, Azure DevOps.
Direct, hands-on experience managing security infrastructure such as IPSs, WAFs, CDN, ELBs, VPC, SIEM and log management technology.
Expert-level architecture and design with Amazon AWS or Azure; CloudFormation, Terraform.