Associate Security Engineering

What you'll do

• Define and oversee the information security and cybersecurity risk posture for the Asset Management Private business.
• Manage and provide strategic direction to GRC, Application Security, and Product Security teams.
• Advise application development teams on integrating security and business resiliency controls into new business applications.
• Assess existing applications for design-related security risks and determine appropriate remediation steps.
• Drive the adoption of embedded application security controls throughout the Software Development Life Cycle (SDLC).
• Provide technical expertise to engineering leadership on emerging threats in web and mobile application spaces.
• Develop customized security testing strategies to complement existing technology risk programs.
• Communicate technology risk impacts and mitigation strategies to technology engineers and business management.

What we're looking for

• 3-5 years of progressive experience in multi-domain information security including vendor security, application security, vulnerability management, data loss prevention, data encryption, and infrastructure security.
• Expert knowledge of global financial regulations such as SEC, FINRA, GDPR, and CCPA.
• Proven experience applying risk management methodologies such as FAIR or similar frameworks.
• Proven ability to build, mentor, and lead high-performing global teams of security professionals.
• Proven track record of collaborating with engineering, technology, second line risk functions, and audit partners to deliver projects and resolve audit issues.
• Exceptional written and oral communication skills to articulate complex technical risks to technical and executive audiences.
• Familiarity with security standards and frameworks such as NIST, OWASP, SANS Top 20, PCI DSS, and CIS Controls.
• Expertise in technology risk data analytics, SDLC best practices, and application security best practices.
• BS or MS degree in Computer Science, Cyber Security, Information Security, or a related technical field (preferred).
• Relevant industry certifications such as CISSP, CISM, CRISC, CISA, or cloud-specific security certifications (preferred).
• Experience with leveraging AI/ML to solve security problems and scale operations (preferred).
• Knowledge of secure coding languages such as Python, Java, or Go (preferred).