Senior Application Security Engineer

描述

Career Area:

Job Description:

Your Work Shapes the World at Caterpillar Inc.

When you join Caterpillar, you're joining a global team who cares not just about the work we do – but also about each other. We are the makers, problem solvers, and future world builders who are creating stronger, more sustainable communities. We don't just talk about progress and innovation here – we make it happen, with our customers, where we work and live. Together, we are building a better world, so we can all enjoy living in it.

Cat Digital is the digital and technology arm of Caterpillar Inc., leveraging the latest technologies to build industry leading digital solutions for our customers and dealers. With over 1.5 million connected assets worldwide, our teams use data, technology, advanced analytics, telematics, and AI capabilities to help our customers build a better, more sustainable world.

Join the Cat Digital Cybersecurity team and help embed security into the application development lifecycle. In this hands-on technical role, you will partner with software engineers, architects, product owners, and leaders to identify and address application security risk while enabling secure delivery. This opportunity is well suited to an experienced software or DevOps engineer who wants to deepen their application security expertise and help teams build and operate modern applications securely.

What You Will Do:

• Partner with application teams to analyze, validate, prioritize, and remediate security findings from automated and manual sources, including static and dynamic testing, penetration testing, and bug bounty programs.
• Provide practical, context-aware security guidance to software engineers, architects, product owners, and leaders; document key decisions and help teams navigate applicable review and approval processes.
• Enable and monitor application security testing tools, such as CodeQL and Rapid7, at the repository or application level in accordance with established processes.
• Coordinate application onboarding and scope for penetration tests and security assurance assessments, then manage resulting findings through the established defect-management process.
• Help application teams improve security maturity through established scorecards and maturity models and collaborate on correction-of-error reports that allow other teams to learn from recurring issues.

What you will have:

• Decision Making and Critical Thinking: Knowledge of the decision-making process and associated tools and techniques; ability to accurately analyze situations and reach productive decisions based on informed judgment.
• Effective Communications: Understanding of effective communication concepts, tools and techniques; ability to effectively transmit, receive, and accurately interpret ideas, information, and needs through the application of appropriate communication behaviors.
• Software Development Life Cycle: Knowledge of software development life cycle; ability to use a structured methodology for delivering and managing new or enhanced software products to the marketplace.
• Software Integration Engineering: Knowledge of software integration processes and functions; ability to design, develop and maintain interfaces and linkage to alternative platforms and software packages.
• Software Product Design/Architecture: Knowledge of software product design; ability to convert market requirements into software product design.

Consideration for top candidates:

• Hands-on software engineering experience in any programming language or framework, with demonstrated interest or experience in application security.
• Experience building or supporting web applications and APIs, including single-page applications and RESTful APIs, on a major cloud platform such as AWS, Microsoft Azure, Google Cloud, or Salesforce.
• Experience interpreting and helping remediate findings from static application security testing, dynamic application security testing, software composition analysis, penetration testing, or similar security-assurance methods.
• Working knowledge of secure-development resources such as the OWASP Top 10, MITRE Common Weakness Enumeration Top 25, OWASP Application Security Verification Standard, or comparable industry guidance.
• Relevant cloud, cybersecurity, or secure software development certifications are preferred, not required. Examples include AWS, Microsoft Azure, Google Cloud, Salesforce, CompTIA Security+, Cloud Security Alliance CCSK, or an ISC2 software security credential.

Additional Details:

• This position requires the candidate to be in Chicago, IL; Peoria, IL or Dallas, TX
• Relocation assistance is NOT available for this position
• Visa sponsorship is NOT available with this position.
• This position will require up to 10% travel

Summary Pay Range:

Compensation and benefits offered may vary depending on multiple individualized factors, job level, market location, job-related knowledge, skills, individual performance and experience. Please note that salary is only one component of total compensation at Caterpillar.

Benefits:

Subject to plan eligibility, terms, and guidelines. This is a summary list of benefits.

• Medical, dental, and vision benefits*

• Paid time off plan (Vacation, Holidays, Volunteer, etc.)*

• 401(k) savings plans*

• Health Savings Account (HSA)*

• Flexible Spending Accounts (FSAs)*

• Health Lifestyle Programs*

• Employee Assistance Program*

• Voluntary Benefits and Employee Discounts*

• Career Development*

• Incentive bonus*

• Disability benefits

• Life Insurance

• Parental leave

• Adoption benefits

• Tuition Reimbursement

* These benefits also apply to part-time employees

Posting Dates:

Any offer of employment is conditioned upon the successful completion of a drug screen.

Caterpillar is an Equal Opportunity Employer, Including Veterans and Individuals with Disabilities. Qualified applicants of any age are encouraged to apply.

Not ready to apply? Join our Talent Community.