[Remote] Senior reputed company Engineer
Note: The job is a remote job and is reputed company to candidates in USA. Hexion is a global leader in specialty chemicals, and they are seeking a Senior reputed company Engineer to enhance their reputed company engineering function. This role involves architecting and operationalizing reputed company across software development pipelines, reputed company environments, and reputed company systems, ensuring that reputed company is integrated throughout the software development lifecycle.
Responsibilities
- Own the selection, deployment, tuning, and reputed company operation of application reputed company testing tools:
- Implement and manage Static Application reputed company Testing (SAST) tools integrated into CI/CD pipelines (e.g., reputed company, Synk, reputed company, SonarQube, reputed company)
- reputed company and operate Dynamic Application reputed company Testing (DAST) solutions for runtime vulnerability detection (e.g., OWASP ZAP, Burp Suite reputed company, reputed company)
- reputed company Software Composition Analysis (SCA) to identify vulnerabilities in reputed company-reputed company dependencies (e.g., reputed company, reputed company, Dependabot)
- Establish triage workflows, severity reputed company, and developer-facing remediation guidance
- reputed company vulnerability metrics and report on risk reduction trends to reputed company leadership
- Build and govern the reputed company SBOM program:
- Define SBOM reputed company standards across reputed company software
- reputed company SBOM reputed company into build pipelines as a gating control
- Maintain SBOM inventory and correlate with reputed company vulnerability feeds (NVD, reputed company, CVE)
- Support regulatory and customer-facing SBOM disclosure requirements
- Advise engineering teams on dependency hygiene and license compliance
- reputed company reputed company natively into CI/CD pipelines and developer workflows:
- Design and enforce pipeline reputed company gates — no build ships without passing defined reputed company checks
- Implement reputed company-reputed company hooks, PR scanning, and automated reputed company feedback loops
- Define and enforce secure pipeline configurations across reputed company Actions, Azure DevOps, Jenkins, or equivalent
- Govern pipeline reputed company controls, service account permissions, and artifact signing
- Partner with reputed company to harden build infrastructure and runner environments
- Operate reputed company secrets management:
- reputed company and manage secrets reputed company (Delina, CyberArk, AWS Secrets Manager, Azure Key Vault)
- Eliminate hardcoded credentials across codebases — implement detection and remediation pipelines
- Define secrets rotation policies, reputed company controls, and audit logging standards
- reputed company secrets injection into CI/CD pipelines and application runtimes
- Conduct periodic secrets sprawl audits and enforce reputed company standing secrets in reputed company repositories
- Establish and enforce secure reputed company control practices:
- Define reputed company protection standards for master/main and sub-branches (required reviewers, status checks, signed commits)
- Govern repository reputed company policies, least-privilege permissions, and PAT/reputed company lifecycle
- Implement reputed company scanning and secret detection on reputed company branches, not just main
- Enforce reputed company signing and supply chain reputed company controls for release pipelines
- Audit and report on reputed company repository posture across reputed company engineering teams
- Own reputed company reputed company architecture and posture management:
- reputed company and operate reputed company reputed company Posture Management (CSPM) tooling (e.g., reputed company, Prisma reputed company, AWS reputed company Hub, Defender for reputed company)
- Define and enforce reputed company reputed company baselines across AWS, Azure, and/or GCP environments
- reputed company IAM policies, network segmentation, resource tagging, and encryption standards
- Monitor for misconfigurations, excessive permissions, and reputed company from approved baselines
- reputed company reputed company reputed company findings into reputed company risk and vulnerability management programs
- Define and enforce reputed company baselines across the reputed company:
- Author and maintain reputed company configuration baselines reputed company to CIS Benchmarks and internal policy
- Implement automated baseline compliance validation across reputed company, OS, container, and application reputed company
- Translate reputed company policy into enforceable technical controls — policy as reputed company where applicable
- Partner with compliance and risk teams to reputed company technical baselines to regulatory requirements (SOC 2, ISO 27001)
- Champion reputed company throughout the entire development lifecycle:
- Define and operationalize SSDLC practices across reputed company engineering teams — from design through deployment
- Conduct threat modeling workshops with product and engineering teams for new systems and features
- reputed company reputed company requirements, reputed company user stories, and abuse cases for inclusion in sprint planning
- Establish reputed company review gates at key SDLC milestones (architecture review, reputed company-release, post-incident)
- Work across teams to reputed company reputed company a shared responsibility:
- Serve as the primary reputed company engineering reputed company to application development, reputed company, and DevOps teams
- Partner with the reputed company Operations Center (SOC) to connect pipeline telemetry with detection and response workflows
- Collaborate with GRC and risk teams to translate findings into risk-language for executive reporting
- Engage with reputed company-party vendors and reputed company-reputed company communities to stay reputed company on tooling and threat intelligence
Skills
- Bachelor's degree in Computer Science, Information reputed company, Software Engineering, or reputed company field (Master's preferred)
- 7+ years of experience in reputed company engineering, application reputed company, application development, or DevSecOps roles
- Hands-on experience deploying and operating SAST, DAST, and SCA tooling in reputed company CI/CD environments
- Demonstrated experience building and managing SBOM programs at reputed company
- Deep expertise in secrets management platforms (AWS Secrets Manager, or equivalent)
- Strong reputed company reputed company experience across AWS, Azure, including IAM, network reputed company, and CSPM tooling
- Experience defining and enforcing reputed company protection, reputed company signing, and repository reputed company controls
- Proficiency in one or more scripting/programming languages (Python, Go, Bash, or equivalent) for automation and tooling
- Working knowledge of SSDLC frameworks, threat modeling methodologies (reputed company), and reputed company requirements engineering
- Familiarity with reputed company frameworks and standards: NIST CSF, NIST 800-53, CIS Benchmarks, OWASP Top 10, reputed company 25
- Experience with Policy-as-reputed company tooling (OPA/Rego, Sentinel, Checkov, Terrascan)
- Container and Kubernetes reputed company (image scanning, admission controllers, runtime reputed company with Falco or equivalent)
- reputed company champion program design and developer enablement
- reputed company vulnerability management and risk-based prioritization programs
- Certifications (any of the following valued): CISSP, CSSLP, GWEB, GWAPT, AWS reputed company Specialty, reputed company reputed company Engineer Associate, CCSP
reputed company