Principal Security Engineer
Job Description
Principal Security Software Engineer
Are you interested in building large-scale distributed software for the cloud Oracle's Service Cloud team is building Software-as-a-Service technologies that operate at high scale in a broadly distributed multi-tenant cloud environment. Our customers run their businesses on our cloud, and our mission is to provide them with best in class compute, storage, networking, database, security, and an ever expanding set of foundational cloud-based services.
We're looking for hands-on engineers with expertise and passion in identifying and resolving difficult security problems in distributed systems, virtualized infrastructure, and highly available services. If this is you, at Oracle you can design and build innovative new systems from the ground up.These are exciting times in our space - we are growing fast, still at an early stage, and working on ambitious new initiatives. An engineer at any level can have significant technical and business impact.
As aPrincipal Security Software Engineer you will review the software design and development for all components of Oracle's Service Cloud team. Develops and execute programs and processes to reduce information security risk and strengthen Oracle's security posture.You should value simplicity and scale, work comfortably in a collaborative, agile environment, and be excited to learn.
Things you'll do:- Penetration testing
- Hardening of network, software and firmware
- Security tool development (e.g. scanning tools)
- Security metrics definition and delivery
- Consult across different software development teams
- Attack vector modeling
- Champion secure coding practices
Minimum Qualifications:
- Bachelor's or Master's degree in Computer Science or related field
- 7+ years of experience in software engineering or related field
- Experience working in a large cloud or Internet software company preferred
- Strong application/product/software security background
- Ability to effectively assess and communicate risks and appropriate levels of urgency to management and engineering staff
- Excellent organizational, verbal and written communication skills
- Ability to succeed through collaboration and working through internal and external organizations and individuals
- Prior DevOps or continuous delivery and deployment experience preferred
- Strong security testing experience with Fortify, Burp, Zap or Webinspect.
- Thorough understanding of latest security principles, techniques, and protocols.
- Security certifications is a plus.
Skills Required:
- Application architecture and design reviews
- Penetration Testing and Vulnerability assessments
- Web Services and API security assessments
- Product Security Assessments and Threat Modeling
- Dynamic Vulnerability Scanningusing automated application scanners
- Execute Secure Code Audits using manual and automated methods to review product codes
- Secure SDLC Processes including DevOps and Agile
- Knowledge of languages, including Java, .Net, PHP, C++, and XML
- Security Testing tools, includingNmap, Nessus, Web Inspect, BurpSuite, ZAP Scanner,Fortify Secure code scanner, SOAP UI, Kali Linux, and Metasploit
- Operating Systems including Windows and Linux
- Cryptographic algorithms, hashing algorithms, encryption and
- Network and web related protocols, including TCP/IP, TLS/SSL, HTTP, and FTP.
Detailed Description and Job Requirements
As a member of the software security team, you will assist in defining and developing software for tasks associated with the security testing of software applications. Provide technical leadership to other software developers. Specify, design and implement modest changes to existing software architecture to meet changing needs.Develop, implement, and enforce Oracle's security policies. Develop, implement, and manage Oracle's compliance with operational security procedures. Develop Security Review threat model and operationalization standards for cloud services to be built and deployed into Oracle's Service cloud.
Duties and tasks are varied and complex needing independent judgment. Fully competent in own area of expertise.
Oracle is an Equal Employment Opportunity Employer. All qualified applicants will receive consideration for employment without regard to race, color, religion, sex, national origin, sexual orientation, gender identity, disability and protected veterans status or any other characteristic protected by law.
Career Level - IC4