Product Security Engineer
1) The tissue in plants that brings water upward from the roots;
2) a leading global water technology company.
Xylem is the leading global provider of efficient and sustainable water technologies and our international team is unified in a common purpose: creating advanced technology and other trusted solutions to solve the world’s water challenges.
We are committed to social responsibility and corporate citizenship through our Xylem Watermark program, where colleagues volunteer their time and talent to provide and protect safe water resources for communities around the world, deliver disaster response, educate children, and raise global awareness about critical water issues. Innovation, diversity and inclusion are also key to our culture.
Our products and services move, treat, analyze, monitor and return water to the environment, in public utility, industrial, residential and commercial building services settings. We develop and provide technologies that improve the way water is used, managed, conserved and re-used. Xylem also provides a leading portfolio of smart metering, network technologies and advanced analytics solutions for water, electric and gas utilities.
If you are excited and passionate about helping us #letssolvewater, we want to hear from you! For more information, please visit us at www.xylem.com
The Role: As member of Xylem’s Product Security team, the Security Engineer is responsible for the implementation and execution of security programs and practices to support a growing, global water technology company. This position will work across software and firmware development teams to identify component and system level technical risks and evaluate critical failure points, determine technical security controls to mitigate risks, and work with cross functional teams to implement features according to product road maps.
You will lead security standards implementation, penetration testing and PSIRT programs of for our entire product portfolio. Your passion for security and in-depth knowledge of Product Security will ensure that you deliver high impact results.
Essential Duties/Principal Responsibilities:
- Work with the business, devops and systems teams to identify the right architecture for implementing new solutions, products and modules. Develop, implement and maintain product security strategy for the entire product portfolio covering IoT and, Smart-device suites
- Conduct complete lifecycle security architecture and technical assessments for a wide range of products, including embedded devices, enterprise software solutions, and mobile apps
- Engage in application and domain-specific threat modeling and attack surface analysis and reduction
- Provide guidance and leadership on best practices regarding security in software and firmware development
- Contribute to the development and evolution of the application and infrastructure security reference architecture. Develop, implement and maintain the security architecture for Xylem product portfolio
- Champion the Xylem security SDLC. This includes security testing, penetration testing, and identifying and fixing vulnerabilities in software and applications on all Xylem products.
- Implement or manage the implementation of common application security controls
- Assist other developers in remediating vulnerability findings by providing line-by-line guidance.
- Provide training and education to developers on software security best practices.
- Expert level operational support for security escalations from customers
- External: Cybersecurity suppliers, industry peers, customers
- Internal: Product Managers, Engineering; Research & Development; DevOps, Developers
Qualifications: Education, Experience, Skills, Abilities, License/Certification:
- BS in Computer Science or equivalent with 5-years of experience
- Demonstrated expertise in product/application security architecture, Network security, application security, web services
- Experience with SAST, DAST, SCA and penetration testing tools
- In-depth experience identifying and protecting against web application and web service security vulnerabilities including those found in the OWASP Top 10 IoT Top 10 and CWE Top 25
- Meaningful experience in multiple programming languages
- Solid knowledge of the browser security model, crypto, and network security. Attacker mindset: Real passion for breaking all the things unbreakable.
- Knowledge of secure infrastructure architectures, application architectures, encryption, Cloud Security and broader security technologies.
- Strong operating systems knowledge Windows (all flavors), Debian Linux
- IoT network technologies (such as Bluetooth/BLE, WLAN, Z-Wave, Zigbee, identity/auth security)
- Experience with wireless technologies such as CDMA, E-HRPD, GSM, UMTS, TDS-CDMA, LTE-FDD / LTE-TDD, and 5Gexperience with Android RIL, Telephony, C and Embedded RTOS.
- Scripting knowledge Linux scripting (bash), Windows scripting, Python or Perl
- Relevant cyber security certifications
- Scripting skills (i.e.: Ruby, Python, Perl, shell scripts)
- Experience in software development
- Experience with cloud IaaS security operations
- Valuable: Preferred: forensic analysis skills
- Valuable: Blockchain experience
Standard weekly job hours: Monday through Friday, normal business hours (40)
Travel requirement: Approximately 15% (domestic and international)
Xylem is an Equal Opportunity Employer. Employment decisions are made without regard to race, color, religion, national or ethnic origin, sex, sexual orientation, gender identity or expression, age, disability, protected veteran status or other characteristics protected by law.