Secure Development Engineer

We are looking for you, if you:

• are passionate about the field of Cybercrime resilience, secure coding practices, secure design and advanced security testing techniques,
• have the hands on experience with testing devices, infrastructure or cloud, networks and applications (including testing web applications and APIs, mobile applications is a plus) and/or knowledge of secure coding aspects in at least one leading programming language (e.g. Java, C#, C/C++/Objective-C, Python, GoLANG, SQL etc.),
• have strong knowledge of current security technologies and emerging trends in the area of cybersecurity,
• have the seamless ability to communicate technical issues in a technical and business language,
• have the ability to support yourself and other team members in development,
• have the ability to act autonomously, think out of the box and deliver actionable items,
• have the ability to establish lasting relations within the organization with engineering organization of ING,
• have good oral and written English communication skills.

You'll get extra points for:

• have a Bachelor or Masters in information technology, cybersecurity or a related field,
• posses certificates like CEH, Offensive Certifications like OSCP, OSWP, SANS Offensive Operations Certificates like GIAC Certified Penetration Tester (GPEN) / Certified Expert Penetration Tester (CEPT) is a plus,
• have a prior or current experience working as a Penetration Tester, Red Team or Cybersecurity consultant or developer with a focus on secure coding and system design.

Your responsibilities:

• providing analysis and monitoring of development environment, quality of tools supporting secure development and design, secure configurations etc. basing on results of security processes embedded into Security Development Lifecycle (SAST, DAST, IAST, SCA, VS, penetration testing and red teaming) and dedicated analysis on the most common vulnerabilities identified in code,
• continuously supporting Global Security Champion Guild having a focus on secure development and engineering to ensure security is embedded by default into each IT or business product at all stages of their lifecycle (Exper Team Secure Development and Engineering),
• delivering of security assessments of IT products, infrastructure, applications or 3rd party services as a mechanism to assess the effectiveness of cybercrime resilience controls in place to protect people, process and technology aspects of ING IT systems,
• providing technical expertise, analytical skills, documentation and coordination support to an expert team or to CoE’s service consumers,
• guiding towards best practices, industry standards and solutions to assure proper security design of IT-Products, expected quality of code and security capabilities delivered out by CoE Offensive Security to assure security is embedded by default,
• providing training and awareness on secure coding practices for developers and security champions
• providing consulting and expert knowledge on specific software issues and vulnerabilities, low quality of code, use of libraries and frameworks, specific security settings of application servers,
• providing accurate technical solutions for identified security issues and design flaws.

Information about the squad:

The ING Global CISO’s Attack Surface Management (ASM) tribe will focus on reducing both the external and well as the internal attack surface of the entire ING organisation, by (automated) hardening of our assets against cyber threats with preventive controls and proactively identifying and remediating vulnerabilities. One of area belonging to the ASM tribe is the Center of Expertise (CoE) Offensive Security including Penetration Testing and Red Teaming Expert Teams and Security Development & Engineering Expert Team. Security Development & Engineering Expert Team is globally responsible for the following activities:

• Providing specific analysis of security issues, confirming hypotheses, testing and certifying new technologies.
• Continuous monitoring of development environment, quality of tools, configurations etc. basing on results of security processes embedded into Security Development Lifecycle (SAST, DAST, IAST, SCA, VS, penetration testing and red teaming) and dedicated analysis on the most common vulnerabilities identified in code.
• Providing training and awareness on secure coding practices for developers and security champions.
• Providing consulting and expert knowledge on specific software issues and vulnerabilities, low quality of code, use of libraries and frameworks, specific security settings of application servers.

Secure Development Engineer role is responsible for supporting the implementation of adequate detective and preventive measures to reduce attack surface of the Bank, as Subject Matter Expert of secure development, flawless coding practices and cybercrime resilient application design.

Secure Development Engineer reports directly to the Expert Lead Secure Development & Engineering.

The role naming convention in the global ING job architecture will be “Engineer IV”.