About You
Galaxy is seeking a VP, Security Architecture to lead overall secure software development lifecycle (S-SDLC) from inception to delivery
We’re looking for a senior expert in security architecture to work closely with our product, infrastructure, and engineering teams to design and deliver secure software solutions at a rapidly growing company
On a given day at Galaxy, you will:
- Champion security throughout the software lifecycle from concept and definition through design and implementation to deployment and ongoing operations
- Work with stakeholders to formulate and implement a strategy for software security tailored to the specific risks facing the application, software, and environment
- Assist peer teams in assessing the security of the applications, software, and operational components including:
- Participate in relevant design and code reviews
- Assist with development and review of test plans to ensure effective security coverage
- Assist teams with mitigating findings including assessment of impacts, possible solutions, and efficacy of remedies
- Provide expertise and advice on cloud application and infrastructure security design patterns
- Assist with implementation and integration of tools and processes for security testing including Static & Dynamic Analysis (SAST/DAST), Vulnerability Information Feeds, and other security automation
- Participate in relevant design and code reviews
- Provide training and thought leadership for secure software development practices
- Be a subject matter expert for security patterns for cloud-based applications and services
You’ve worked hard for:
- 7+ years’ experience in cybersecurity, software engineering, computer science with a focus on security, or related field
- Bachelor’s degree in cybersecurity, software engineering, computer science, or related field
- Certifications in Application Security or Penetration Testing such as OSCP, OSCE, OSWE and CEH or cybersecurity certifications including CISSP, CISM, CompTIA Security+ and GSEC are encouraged
- Proficient to expert technical skills in several of the following:
- One or more development languages: C/C++, Java, Javascript, or Python
- Application architectural patterns, such as MVC, Microservices, Service Oriented Architecture, Serverless, Message bus/event driven, etc
- IP networking, firewalls, network security rules, etc
- Cloud computing technologies (AWS, GCP) and delivery patterns (PaaS, IaaS, serverless, etc)
- Common attacks and vulnerabilities including OWASP Top 10 and SANS CWE 25
- Agile fundamentals like Test Driven Development, backlog management, and user stories
- Continuous Integration/Testing/Delivery tools and techniques and agile development methodologies including TDD/XP/Scrum/Kanban
- One or more development languages: C/C++, Java, Javascript, or Python
- Understanding and experience with privacy concepts including privacy by design, GDPR, PIAs, and personal data handling and security profile standards like CIS Benchmarks and DISA STIGs
- Self-starter with strong business acumen
- Ability to work independently and with application development, quality assurance, DevSecOps, and peer security teams
- Excellent verbal and written presentation skills with a proficiency in English