About Your Role:
Dotdash Meredith is looking for an Application Security Engineer with a track record of innovative thinking, technical expertise, and collaboration. This role will be tasked with supporting software development teams, vulnerability management and remediation, and improving security coverage throughout the SDLC.
As a valued member of the Security team, you will be responsible for helping to set technical direction, delivering technical projects, and collaborating with other groups within the organization.
This position offers remote work flexibility; however, if you reside within a commutable distance to one of our main offices in New York, Des Moines, Birmingham, Los Angeles, Chicago, or Seattle, the expectation is to work from the office three times per month.
About Your Contributions:
Solutions
● Function as a subject matter expert for security solutions within the organization’s platform.
● Integrate security solutions into the SDLC process.
● Work with development teams to improve the security of CI/CD processes by ensuring version control for source code, scanning code for vulnerabilities in the build pipeline, and ensuring public/private repositories are trusted and secure.
● Design and develop coding standards across infrastructure, application, and data security, building out guidelines and standards to drive a standardized set of security requirements that align with internal policies and meet external compliance/regulatory requirements.
● Help evolve application security functions and services.
Vulnerability Assessment
● Prioritize, triage and remediate vulnerabilities and findings from security scans and bug bounty programs.
● Review security test results from vulnerability scans and penetration tests and propose appropriate remediation measures or mitigation controls, conduct a remediation plan and supervise its progress.
● Improve and support application security tool deployments including static analysis, dynamic testing and software composition analysis tools.
● Conduct security code reviews for various languages and frameworks of web and mobile applications.
● Identify security exposures and develop mitigation plans.
● Investigate and report vulnerabilities in systems and platforms.
● Assess the application threat landscape through threat modeling and architecture reviews.
● Develop metrics and reporting on the posture of the application security program.
About You:
Technical Skills
● 2+ years experience in a security technical role or software development.
● Development experience in Java, JavaScript and Python.
● Scripting and automation experience using RESTful API’s.
Application Development and Security
● Knowledge of SANS/CWE Top 25, OWASP Top 10 Application Security principals.
● Experience with application security tooling and processes, including code review, static code analysis, penetration testing, risk management, etc.
● Strong knowledge and experience in implementing SDLC best practices.
● Knowledge with Git and version control best practices.
● Ability to innovate and find creative solutions that balance business needs with security needs.
● Familiarity with application layer assessment tools, such as local proxies and fuzzers.
● Familiarity with threat modeling and security design review methodologies.
Infrastructure
● Solid understanding of OSI model, TCP/IP, HTTP and TLS.
● Knowledge of C.I.A. (confidentiality, integrity, availability) security principles and D.I.E. (distributed, immutable and ephemeral) security model.
● Experience with data encryption, cryptography and encryption key management.
● Experience with configuration management and DevOps practices to ensure security is built into the SDLC process.
Preferred Skills:
● Passion for application security and continuous learning.
● Able to concisely communicate security risks to both technical and business audiences.
● Attention to detail.
● Ability to work independently, and as part of a team.
● Ability to multitask and prioritize work effectively.
What the Team is Saying
What We Do
Dotdash Meredith's vibrant brands help over 200 million users each month find answers, solve problems, and get inspired. Dotdash is among the largest and fastest growing publishers online, and has won over 50 awards in the last year alone, including Digiday's 2020 Publisher of the Year. Dotdash Meredith brands include Verywell, Investopedia, The Balance, The Spruce, Simply Recipes, Serious Eats, Byrdie, Brides, People, Food & Wine, Shape, Entertainment Weekly, Travel & Leisure, Better Homes and Gardens, Southern Living, Health, InStyle, Parents, EatingWell, Magnolia Journal, MyDomaine, Lifewire, TripSavvy, Liquor.com, and TreeHugger.
Gallery
Dotdash Meredith Offices
Hybrid Workspace
Employees engage in a combination of remote and on-site work.
Our employees work 3 days in office across our NYC, Des Moines, Birmingham, Seattle, LA, and Chicago locations. A couple of our orgs have remote teams (please refer to job descriptions). We are accommodating towards various exemptions and situations.
