Sony Playstation
Sr Application Security Engineer
Sony Playstation, San Diego, California, United States, 92189
Why PlayStation?
PlayStation isn’t just the Best Place to Play — it’s also the Best Place to Work. Today, we’re recognized as a global leader in entertainment producing The PlayStation family of products and services including PlayStation5, PlayStation4, PlayStationVR, PlayStationPlus, acclaimed PlayStation software titles from PlayStation Studios, and more.
PlayStation also strives to create an inclusive environment that empowers employees and embraces diversity. We welcome and encourage everyone who has a passion and curiosity for innovation, technology, and play to explore our open positions and join our growing global team.
The PlayStation brand falls under Sony Interactive Entertainment, a wholly-owned subsidiary of Sony Corporation.
Do you want to help bring PlayStation technology to a worldwide audience? Are you passionate about securing infrastructure that constantly pushes the boundary of the gaming industry? Are you ready to work with innovative technology, forward-thinking engineers, and a passionate security team? If so, join us!
You will get the opportunity to be part of our proactive defense team that is focusing on vulnerability management, use-case based penetration testing, working with our bug bounty program and handling security incidents on our services and clients.
Key Responsibilities
Collaborate with engineers, consultants and leadership to address security risks and provide mitigation recommendations within the Secure Development Lifecycle (SDLC). Perform validation of security controls to ensure alignment with compliance and industry best practices. Perform manual security testing of products and services to proactively discover vulnerabilities and track them to resolution with developers. Working with vulnerabilities identified by our SAST, SCA, DAST tools, from triage to remediation of valid findings with our development organizations. Investigate and triage vulnerabilities reported from Responsible Disclosure program. Effectively communicate and work with development teams, guiding them in the remediation of security issues detected in their applications, services and other areas. Determine and recommend remediation guidelines for vulnerabilities to developers and other technical audiences. Qualifications
5+ years previous experience in information security. 3+ years of penetration testing (or related) experience. 2+ years’ experience working within software development. Bachelor’s degree in Computer Science/Information Security/Cyber Security or equivalent. Excellent written and oral communication skills, as well as social skills including the ability to articulate to both technical and non-technical audiences. Must have the ability to work both independently as well as collaborate with engineering teams and multi-task effectively. Strong understanding of application security weaknesses for various technologies including web applications, databases, and multi-tier applications. Ability to review source code and explain mitigation controls within source code for languages including, Java, Go, Python, C/C++, Scala etc. Experience with AWS technologies. Experience with application security scanning tools such as SAST, SCA and DAST. Experience with testing tools such as Burp Suite, OWASP ZAP, Appscan, Responder, Metasploit, PowerSploit, Wireshark, and other solutions. Desired Experience
Excellent analytical, evaluative, and problem-solving abilities. Self-driven and capable of assessing areas of responsibility for continuous improvement. Knowledge of automated attack tools and developing mitigation techniques. Hacker Mindset and always strives to think like an attacker. Cloud experience with Azure or Google Cloud Platform. Technical certifications within information security are a plus (OSCP or other SANS training such as GPEN, GWAPT, GXPN or equivalents). Experience with C2 frameworks such as Cobalt Strike, Metasploit or Empire. Experience with different development methodologies such as Agile, DevOps etc.
#J-18808-Ljbffr
Collaborate with engineers, consultants and leadership to address security risks and provide mitigation recommendations within the Secure Development Lifecycle (SDLC). Perform validation of security controls to ensure alignment with compliance and industry best practices. Perform manual security testing of products and services to proactively discover vulnerabilities and track them to resolution with developers. Working with vulnerabilities identified by our SAST, SCA, DAST tools, from triage to remediation of valid findings with our development organizations. Investigate and triage vulnerabilities reported from Responsible Disclosure program. Effectively communicate and work with development teams, guiding them in the remediation of security issues detected in their applications, services and other areas. Determine and recommend remediation guidelines for vulnerabilities to developers and other technical audiences. Qualifications
5+ years previous experience in information security. 3+ years of penetration testing (or related) experience. 2+ years’ experience working within software development. Bachelor’s degree in Computer Science/Information Security/Cyber Security or equivalent. Excellent written and oral communication skills, as well as social skills including the ability to articulate to both technical and non-technical audiences. Must have the ability to work both independently as well as collaborate with engineering teams and multi-task effectively. Strong understanding of application security weaknesses for various technologies including web applications, databases, and multi-tier applications. Ability to review source code and explain mitigation controls within source code for languages including, Java, Go, Python, C/C++, Scala etc. Experience with AWS technologies. Experience with application security scanning tools such as SAST, SCA and DAST. Experience with testing tools such as Burp Suite, OWASP ZAP, Appscan, Responder, Metasploit, PowerSploit, Wireshark, and other solutions. Desired Experience
Excellent analytical, evaluative, and problem-solving abilities. Self-driven and capable of assessing areas of responsibility for continuous improvement. Knowledge of automated attack tools and developing mitigation techniques. Hacker Mindset and always strives to think like an attacker. Cloud experience with Azure or Google Cloud Platform. Technical certifications within information security are a plus (OSCP or other SANS training such as GPEN, GWAPT, GXPN or equivalents). Experience with C2 frameworks such as Cobalt Strike, Metasploit or Empire. Experience with different development methodologies such as Agile, DevOps etc.
#J-18808-Ljbffr