Qualifications
Key Responsibilities:
Implement Security Controls in SDLC: Assist in the integration of security automation into pipelines (e.g., GitHub Actions/ArgoCD for SAST/DAST/SCA, SBOM generation, and vulnerability scanning).
Support Shared Libraries and Infrastructure: Contribute to the evolution of standard libraries and infrastructure for authentication, authorization, logging, and other runtime security features, including testing and updates.
Contribute to CMMC Compliance: Provide hands-on support for implementing controls (e.g., encryption, secure configurations, monitoring) to meet or exceed CMMC Level 2 requirements, building on our ISO 27001 foundation.
Assist with Reviews and Models: Participate in security architecture reviews, code audits, and threat modeling; identify and remediate issues such as API vulnerabilities or supply chain risks.
Team Collaboration: Engage in code reviews, pair programming sessions, and tooling development to promote secure practices; offer peer support within the security engineering team.
Required Qualifications:
Experience: A minimum of 5 years in software or security engineering, including at least 3 years in security-focused roles. Familiarity with secure cloud systems (AWS), CI/CD security, and compliance efforts (e.g., NIST, CMMC, or FedRAMP).
Technical Expertise: Proficiency in container security (Docker/Kubernetes) and various security tools.
About the job
About the Role
As a Senior Software Engineer specializing in Product Security, you will engage in the hands-on design and implementation of security-focused software solutions. Your primary objective will be to integrate security into our development processes from the outset. This includes the incorporation of automated controls like Software Bill of Materials (SBOM) and vulnerability scanning within our CI/CD pipelines. You will also be responsible for maintaining and enhancing our internal libraries and infrastructure related to authentication, authorization, and logging, while aiding in the deployment of monitoring tools for operational services. Additionally, you will work closely with the Principal Security Engineer and various teams to align our systems with NIST 800-171/CMMC requirements.
In this impact-driven environment, you will prioritize the delivery of secure code and architecture, with minimal bureaucracy. You may occasionally participate in security discussions with government entities under the guidance of the Principal Security Engineer.
Approximately 80-90% of your work will be hands-on, with the remaining time dedicated to collaboration and learning.
About Spire
At Spire, we are dedicated to creating innovative solutions that enhance product security across various sectors. Our team thrives in a dynamic environment that prioritizes impact and collaboration, ensuring that security is a fundamental part of our development processes.