Digital Technology Specialist - Product Security

Accountabilities: Application and product security: Perform penetration testing and vulnerability assessments across web applications, APIs, cloud environments, and containerized applications. Identify, validate, prioritize, and communicate security findings, working with development teams to drive effective remediation. Threat modeling and secure design: Conduct threat modeling and security design reviews for new products, features, and applications, providing practical recommendations to reduce security risks from the outset. Secure SDLC and DevSecOps: Integrate security controls throughout the Software Development Lifecycle and collaborate with developers, architects, and DevOps teams to implement security-by-design principles. Security automation: Integrate and optimize security tools within CI/CD pipelines, support security automation initiatives, and contribute to policy-as-code practices. Application security testing: Execute and interpret results from Static Application Security Testing (SAST), Dynamic Application Security Testing (DAST), Software Composition Analysis (SCA), container security scanning, secret detection, and code scanning tools. Vulnerability management: Triage security findings, reduce false positives, assess risk based on business and technical impact, and coordinate remediation with engineering teams. Cloud and container security: Assess and strengthen the security of cloud-native applications, containerized workloads, Kubernetes environments, and infrastructure-as-code configurations. AI security and AI-SSDLC: Evaluate security risks associated with AI-assisted software development and AI-enabled applications, contributing to the implementation of an AI Secure Software Development Lifecycle. AI threat assessment: Review AI-generated code for vulnerabilities and unsafe design patterns, contribute to AI threat modeling, and assess risks involving AI agents, prompt injection, model misuse, and AI supply chain security. Developer enablement: Deliver security coaching, awareness sessions, and technical guidance to engineering teams, helping developers understand vulnerabilities and apply secure coding practices. Security standards and best practices: Develop actionable security guidelines, technical standards, and recommendations that promote a consistent security-first culture across product engineering teams. Continuous improvement: Monitor emerging cybersecurity threats, security technologies, and AI-related risks to strengthen product security practices and improve the effectiveness of security controls. Requirements Bachelor's or Master's degree in Computer Science, Cybersecurity, Software Engineering, or a related technical discipline. 5–8 years of professional experience in Application Security, Product Security, Penetration Testing, Secure Software Engineering, or a closely related field. Strong understanding of modern software development practices, the Software Development Lifecycle, and secure-by-design engineering principles. Practical experience conducting manual and automated penetration testing and application vulnerability assessments. In-depth knowledge of common application security vulnerabilities, including the OWASP Top 10, API security risks, and secure coding practices. Strong programming or scripting skills in one or more languages, such as Python, Java, JavaScript, C#, Go, or C++. Hands-on experience with application security testing tools, including SAST platforms such as Checkmarx, Coverity, Fortify, Veracode, or CodeQL, and DAST tools such as Burp Suite, AppScan, Veracode, or OWASP ZAP. Experience with open-source security and software composition analysis tools, such as Black Duck, Mend, Snyk, or Dependency-Check. Familiarity with container security platforms, such as Prisma Cloud, Wiz, Aqua, or Trivy, and experience securing cloud-native and containerized applications. Knowledge of development and deployment platforms, including GitHub, GitLab, Azure DevOps, and Jenkins, with experience integrating security controls into CI/CD pipelines. Understanding of Kubernetes, container platforms, and infrastructure-as-code security. Familiarity with AI security concepts, including AI Secure SDLC, large language model and AI agent security, prompt injection, model misuse, secure AI application development, and AI supply chain security. Strong analytical and problem-solving skills, with the ability to assess complex technical risks and translate findings into actionable remediation recommendations. Effective communication and collaboration skills, particularly when working with software engineers, architects, DevOps teams, and other technical stakeholders. A proactive, detail-oriented approach to vulnerability management, continuous improvement, and developer education. Benefits Flexible working arrangements: Options to work remotely or from another office location, with office visits when required. Flexible hours: Ability to adjust working hours to support productivity and work-life balance. Healthcare: Comprehensive private medical care options. Life and disability protection: Access to life insurance and disability programs. Financial benefits: Tailored financial programs designed to support employees' needs. Additional benefits: A range of elected or voluntary benefits. Well-being support: Work-life balance policies and activities designed to support physical and mental well-being. Professional development: Opportunities for training, skill development, and career growth in product security, cloud security, DevSecOps, and emerging AI security practices. Global collaboration: Exposure to international teams, advanced technologies, and security challenges within the energy technology sector. Purpose-driven work: The opportunity to help develop safer, more secure, and more efficient technologies that support the future of energy.