Senior Security Engineer

The Opportunity:

As a key member of the Security & Compliance team, you will contribute to a positive security culture for the organization by protecting the confidentiality, integrity, and availability of data and assets while assisting TrueCar in meeting our strategic goals. This role will champion organizational security through positive knowledge-sharing, training, influencing, and conduct. 

How you will contribute to TrueCar’s success:

• Drive discussions concerning system configurations, deployment, monitoring, alerting, security tooling, processes, and general secure architecture
• Triage alerts and lead mitigations
• Take ownership of standard operating procedures (SOPs) and assist with reviewing and writing policies
• Work with development teams to securely design the architecture and processes of computer systems, networks and information. This includes security considerations as part of the SDLC process. 
• Coordinate penetration testing and vulnerability assessments to identify security strengths and weaknesses, assess the effectiveness of existing controls, and provide recommendations for remedial action where needed.
• Identify, define, and help implement system security requirements based on industry best practices and obligations to third parties.
• Develop technical solutions and operationalize existing security tools to help mitigate security vulnerabilities and automate repeatable tasks.
• Assess and recommend proper security procedures to manage third-party risk and ensure that partners, dealers, and associated agencies follow TrueCar security requirements.
• Work with internal and external auditors to convey security controls and resolve audit findings
• Work with Compliance on ad-hoc company-wide projects and help automate and operationalize dashboards for easy reporting.
• Act as a key resource for investigating security incidents, triaging, and incident response. 

Your Expertise:

• Demonstrated success in a security engineering role
• Excellent verbal and written communication skills
• Collaborate well with technical and non-technical teams
• Possess a growth mindset and bias for action 
• Lead security-related tasks and projects
• Proven ability to configure a variety of security tooling, networking, servers, and/or endpoints (DLP, SAST, DAST, EDR, Proofpoint)
• Ability to script and configure automation tooling
• Understand the tactics, tools, and procedures (TTPs) of threat actors and how to mitigate exploitation
• Ability to identify a variety of Indicators of Compromise (IOCs) and mitigation strategies
• Understand IAM and user lifecycle best practices
• Conduct proactive threat hunting and/or penetration testing
• Understand attack methods, indicators of compromise, and mitigation strategies to protect against threat actors
• Understand OWASP top 10, CIS top 18, NIST, SOC 2
• Working knowledge of Cyber Kill Chain, MITRE ATT&CK, and/or STRIDE
• Understand IAM and directory services
• Working knowledge of email/DNS configuration best practices, cloud environments, automation tooling (Terraform, Ansible), and web frameworks/infrastructure fundamentals
• Security+, Network+, GPEN, GWAPT, GCED, CISA, CISM, AWS Solutions Architect, AWS DevOps Engineer and/or ITIL certifications preferred

Base salary range: $106,000 - $162,000

Tags