DevSecOps & Secure-SDLC Engineer
Marsh & McLennan Companies3 months ago
Cluj-Napoca, RomaniaSenior
Responsibilities
- Lead initiatives related to DevSecOps and Secure-SDLC.
- Enhance the Secure-SDLC framework and align it with the Application Development Security Policy.
- Select and standardize application security tools, including vendor assessments and full proofs of concept.
- Integrate Secure-SDLC requirements and security policies into DevSecOps processes.
- Define application security requirements and standards for agile, traditional, cloud, and containerized architectures.
- Advise application security leadership on shift-left practices, application security tools, CI/CD processes, and secure development capabilities.
- Assess existing security tools and software development lifecycle processes and identify improvement opportunities.
- Document Secure-SDLC and DevSecOps frameworks and process guidelines for internal users.
- Assess the impact of new security industry publications and trends on application security programs and tooling roadmaps.
- Promote secure coding standards and application security processes.
- Automate and integrate security scanning and analysis tools into DevSecOps pipelines.
- Develop, implement, and roll out Secure-SDLC and DevSecOps automation and toolchains.
- Implement sensors to collect metrics for statistics and reporting.
- Serve as the subject matter expert for Secure-SDLC and DevSecOps.
- Advise on processes and standards supporting the Application Development Security Policy.
- Assess tooling and remediation of threats and vulnerabilities in software, applications, and hosting environments.
Requirements
- At least 5 years of DevSecOps and Secure-SDLC work experience.
- CISSP, CSSLP, cloud security, DevSecOps automation, or a similar qualification or specialization is required.
- Post-secondary education or equivalent experience as a DevSecOps Engineer.
- Experience designing Secure-SDLC processes and supporting tooling.
- Experience with software and application analysis tools such as SAST, DAST, SCA, threat modeling, and supply-chain security.
- Hands-on experience automating and integrating security scanning and analysis tools into DevSecOps pipelines.
- Experience with one or more programming languages.
- Familiarity with OWASP Top 10, SANS Top 25, and CWE security frameworks.
- Ability to identify application security requirements and develop solutions using industry best practices.
- Ability to assess tooling and remediation for software and application threats and vulnerabilities.
Benefits
- Hybrid work arrangement with at least three days per week in the Cluj-Napoca office.
- Professional development opportunities, interesting work, and supportive leadership.
- A yearly budget and flexible benefits package of up to 20% of annual salary.
- More than 30 days off, including 25 legal days, a birthday day off, public holiday replacement days, and extra buy/sell options.
- Performance bonus scheme.
- Matching charity contributions, charity days off, and a Pay it Forward charity challenge.
- Pension, life insurance, medical insurance, meal vouchers, and travel insurance.
Categories
About Marsh & McLennan Companies
Marsh McLennan is a global professional services firm providing risk, insurance and reinsurance brokerage, health, wealth, and management consulting to corporations, governments, and nonprofits. It operates through Marsh, Guy Carpenter, Mercer, and Oliver Wyman, earning fees and commissions for advisory, analytics, and placement services. Founded in 1905 and headquartered in New York, it is publicly traded on the NYSE under the ticker MMC.