Upbound Group - Draper, UT
posted about 2 months ago
As a Senior Application Security Engineer for Upbound Group, you will play a crucial role in supporting various processes and procedures related to application security. Your primary responsibility will be to gather information from product engineering teams and promote a culture of security within the engineering organization. You will collaborate closely with engineers to produce more secure applications and ensure that security processes and procedures are operating efficiently and effectively. This role involves not only supporting developers in their efforts to secure applications but also assisting in the documentation and tracking of various application security and cloud initiatives. In this position, you will work collaboratively with engineers, consultants, and leadership to address security risks and provide mitigation recommendations within the Secure Development Lifecycle (SDLC). You will be responsible for building automated code scanning tools to identify security vulnerabilities in both application and infrastructure code, utilizing both open-source and commercial tools. Integrating these tools with the CI/CD pipeline will be a key aspect of your role, enabling secure-by-default best practices by developing libraries and frameworks to prevent future vulnerabilities. You will operate at an enterprise scale by building and managing tools that help test, monitor, and improve application security. Additionally, you will develop security standards, preferred implementation patterns, secure common frameworks, and create developer documentation and educational materials. Providing secure developer training to software engineers on how to write secure code and follow best practices will also be part of your responsibilities. Conducting web application penetration testing, code scanning, and dependency scanning that can be incorporated into the SDLC process and CI/CD pipeline will be essential to your role. You will work closely with the development team to provide guidance and mitigate security vulnerabilities, perform security architecture and design reviews of all systems and applications developed at Acima, and take a leadership role in the development, implementation, and maintenance of consistent application and infrastructure architecture security programs.