Senior Application Security Engineer-Laurel Road

Profile

Location:
13520 Evening Creek Dr N. - San Diego, California 92128
About the Company
Laurel Road is a mission-based consumer FinTech company. Since our founding in 2014, we've done over $10bn in business across Student Loans, Mortgages, and Personal Loans, driven by our award-winning web-applications. Our technology dramatically simplifies the process for both members (our customers) and our bankers, creating experiences that delight - our Net Promoter Scores are above 70, double the industry average. In 2019, Laurel Road was acquired by Key Bank, one of the largest banks in the country. The acquisition has given Laurel Road the resources of a Fortune 500 company, but with the agility and innovation of a startup, allowing us to invest in the next generation of FinTech.
About the Position
We are looking for an Application Security Engineer to play a principal role on a team of brilliant engineers as we expand and improve our ever-growing suite of financial offerings. You will use latest platforms and tools, such as Terraform, GCP (GKE, Secret Manager, IAM, Service Accounts, DNS, NAT, VPC Peering, Cloud Armor, Firewall, Logging, Monitoring), Kubernetes (Workload Identity, RBAC, KSA, Namespaces), and work inside a complex financial infrastructure spanning both on-prem and cloud, with an Akamai CDN, BIG-IP load balancers, and VM Series firewalls. As an Application Security Engineer, you'll be in charge of our department's security infrastructure, with the primary focus of expanding our IaC.
If you are interested in revolutionizing the financial industry while working with a driven and collaborative team, this is the role for you.
Primary Responsibilities
Lead automation of security processes. Instruct the team on proper SDLC and IaC practices. Architect the security automation framework, organize configuration templates, identify best libraries and tools. Use Jira to track progress. Manage security git repositories. Encourage the team to document everything they've done, and to follow Dev/Test/Prod.
Take ownership of major parts of our infrastructure. Manage your own priorities based on departmental and organizational guidance.
Collaborate with engineering, infrastructure, and security stakeholders across the organization.
Highly organized. Strong documentation, communication, and leadership skills.
Knowledge of core infrastructure concepts such as load balancing, REST, and caching. Knowledge of various Internet protocols, SSL termination, auto-scaling, CDN, DNS, OSI layers, threads.
Knowledge of core security concepts, such as zero trust, defense in depth, layering, NGFW, L4 and L7 firewalls, VPN/IPSec, encryption at rest and in flight, password and certificate management. General knowledge of IDS/IPS and security best practices.
Systematic diagnosing, debugging, and problem solving. Experience with basic troubleshooting tools, such as telnet, nmap, nc, and openssl.
Experience with configuration orchestration tools like Terraform and CloudFormation, configuration management tools such as Ansible and Puppet, and key management, like Vault, KMS, and HSM.
Implement risk mitigation strategies. Adopt systems to account for prevalent security threats and changes in regulations. Plan and advise management on changes to our security posture.
Implement incident management strategies, including investigation, escalation, remediation, recovery, hardening, and documentation.
Set up and maintain security monitoring. Manage audit logs. Experience with monitoring and logging tools, such as New Relic, Dynatrace, Prometheus, AWS CloudWatch, GCP Cloud Monitoring, and log aggregation and visualization tools, like the ELK stack, AWS CloudTrail, and GCP Cloud Logging.
Scan for vulnerability and policy violation: recommend configuration changes to address external threats, internal threats, and regulatory compliance. Manage security and compliance self-assessment tests. Recommend assessment tools. File and present reports.
Manage cryptographic resources, such as keys and certificates: creation, rotation, revocation, and automation.
Set up authentication and authorization for both user and system accounts. This includes account, group, and role provisioning, policy and ACL assignment, system integration, and plugin configuration.
Document security infrastructure for internal use and for compliance audits.
Set up systems that make good use of technology utilized throughout the company.
About the Environment
GCP
Kubernetes
Terraform
Python/Ruby/Bash
Firewalls and many other tools and practices for layered security
Required Qualifications
5 combined years of SecOps and DevOps.
AWS, GCP, or similar platforms
Self-sufficiency
Development and scripting experience with languages such as Python, Ruby, Java, Go, and bash.
Knowledge of some configuration orchestration and configuration management tools.
Preferred Qualifications
Knowledge of more advanced security concepts: protocol handshakes, port scanning, http content signatures, and tcpdump.
Some experience with configuration orchestration tools such as Terraform and CloudFormation, configuration management tools such as Ansible and Puppet, and key management, like Vault, KMS, and HSM.
Understanding of Agile concepts
Some SQL
Experience in large enterprise companies
Experience in startup companies
Independent projects
Knowledge of object-oriented architecture.
Bachelor degree in Computer Science
Experience with F5 BIG-IP: DNS, LTM, APM, ASM.
Experience with Palo Alto: VM-Series, Prisma, Wildfire, URL Filtering, Twistlock
Experience with Akamai, Jenkins, Postgres, Apache Tomcat, Ubuntu, ELK
To apply, submit the application online or email your resume to: ****
COMPENSATION AND BENEFITS
This position is eligible to earn a base salary in the range of $84,375- $185,625 annually depending on job-related factors such as level of experience. Compensation for this role also includes eligibility for short-term incentive compensation and deferred incentive compensation subject to individual and company performance. Please click
for a list of benefits for which this position is eligible.
Key has implemented a role-based Mobile by Design approach to our employee workspaces, dedicating space to those whose roles require specific workspaces, while providing flexible options for roles which are less dependent on assigned workspaces and can be performed effectively in a mobile environment. As a result, this role may be mobile or home based, which means you may work either at a home office or in a Key facility to perform your job duties.
KeyCorp is an Equal Opportunity and Affirmative Action Employer committed to
building a diverse, equitable and inclusive culture
. All qualified applicants will receive consideration for employment without regard to race, color, religion, sex, sexual orientation, gender identity, national origin, disability
veteran status or other protected category.
Qualified individuals with disabilities or disabled veterans who are unable or limited in their ability to apply on this site may request reasonable accommodations by
emailing
KeyCorp is an Equal Opportunity and Affirmative Action Employer committed to engaging a diverse workforce and sustaining an inclusive culture. All qualified applicants will receive consideration for employment without regard to race, color, religion, sex, sexual orientation, gender identity, national origin, disability or veteran status.

Company info

Sign Up Now - WashingtondcCrossing.com