Senior Software Security Engineer
Company Overview
At Motorola Solutions , we believe that everything starts with our people. We’re a global close-knit community, united by the relentless pursuit to help keep people safer everywhere. We build and connect technologies to help protect people, property and places. Our solutions foster the collaboration that’s critical for safer communities, safer schools, safer hospitals, safer businesses, and ultimately, safer nations. Connect with a career that matters, and help us build a safer future.
Aperçu de l’entreprise
Chez Motorola Solutions , nous pensons que tout commence par nos employés. Nous sommes une communauté mondiale soudée, unie par la volonté incessante de contribuer à la sécurité des personnes partout dans le monde. Nous concevons et connectons des technologies qui contribuent à protéger les personnes, les biens et les infrastructures. Nos solutions favorisent la collaboration essentielle pour améliorer la sécurité des populations, des écoles, des hôpitaux, des entreprises et, finalement, des nations. Connectez-vous à une carrière qui compte et aidez-nous à bâtir un avenir plus sûr.
Department Overview
The Senior Software Security Engineer will be responsible for analyzing software designs and implementations from a security perspective, identifying and proposing remediations to security issues throughout the software development lifecycle (SDLC).
Job Description
Responsibilities:
Security Design and Implementation
- Perform threat modeling, risk assessments, and architecture reviews to identify and mitigate risk.
- Support the engineering teams on detailed security requirements to meet compliance requirements and industry best practices.
- Perform security code reviews looking for potential security vulnerabilities.
- Act as a subject matter expert to advise and answer questions from engineering and compliance teams on technical product security matters.
Security Testing
- Define and oversee the deployment of Software Composition Analysis (SCA) tools to compile SBOMs of software components, helping to identify known vulnerabilities and license compliance violations.
- Define and oversee the deployment of automated security testing tools into CI pipelines, including Static Application Security Testing (SAST), Dynamic Application Security Testing (DAST), and Secret Detection scanning tools.
- Manual penetration testing of web applications (backend and frontend).Manual penetration testing skills in the domains of cloud infrastructure, embedded/OS or mobile are desirable.
- Write custom scripts or unit test cases to check for vulnerabilities or broken/missing security controls.
- Recommend improvements to existing security scanning tools and processes, and propose new ones.
Vulnerability Management
- Triage the findings from the automated security scanning tools.
- Validate potential security vulnerabilities to determine whether they are actual true positives, or false positives (i.e. non-applicable) in the product context. Write proof of concept exploits when necessary to achieve this.
- Assess the risk of vulnerabilities and threats in order to help the business determine their remediation priority order.
- Communicate the identified security issues to engineering and compliance stakeholders, and manage them throughout the SDLC process to ensure they are properly addressed.
SDLC and DevSecOps Integration
- Establish and maintain secure coding standards, baseline product security requirements and more general best practices to provide guidance to development teams.
- Assist the program area with implementing a secure Continuous Integration/Continuous Delivery (CI/CD) pipeline utilizing DevSecOps principles and practices to increase automation.
- Implement automated security controls as part of CI/CD pipelines.
Incident Response and Compliance
- Support product security incident response processes, including root cause analysis (identify the affected product componen