• Collaborate with engineers, consultants, and leadership to address security risks and provide mitigation recommendations within the Secure Development Lifecycle (SDLC)
• Build automated code scanning tools to identify security vulnerabilities in application code and infrastructure code using both open source and commercial tools Integrating open-source and/or commercial static application code scanning tools with the CI/CD Pipeline
• Enable secure-by-default best practices by developing libraries and frameworks to prevent future vulnerabilities
• Operate at enterprise scale by building and managing tools that help test, monitor, and improve application security
• Develop security standards, preferred implementation patterns, secure common frameworks, and developer documentation and educational materials
• Provide secure developer training to software engineers on how to write secure code and follow best practices
• Conduct web app penetration testing, code scanning, dependency scanning that can be incorporated into SDLC process and CI/CD pipeline
• Work closely and together with the development team to provide guidance and mitigate security vulnerabilities
• Perform security architecture and design reviews of all systems and applications developed at Acima.
• Provide a leadership role in the development, implementation and maintenance of consistent application and infrastructure architecture security programs.

Required Qualifications

• 3+ years of experience working in an application security role
• Background in web application development and/or code auditing and ability to get deep into the code to find and resolve security problems
• Experience with static and dynamic code analyzers
• Experience with software composition analysis tools
• Web application penetration testing and source code vulnerability analysis skills
• Extensive knowledge of internet security issues, cloud architectures, and threat landscape
• General understanding of application and cloud security threats and vulnerabilities, including OWASP top 10, SANS top 25 etc.
• Professional security certification: CISSP, GIAC, GWEB, GWAP or other similar credentials.
• Experience with BurpSuite, Zed Attack Proxy (ZAP), or similar dynamic testing tool

Preferred Qualifications

• Knowledge of current development practices, including containerized applications, microservice architectures, serverless architectures, native mobile applications, responsive web applications, etc.

Benefits/Compensation:

• DTO (discretionary time off).
• Medical insurance with United Healthcare (IHC network)
• Health Savings Account (HSA) with company contribution.
• Dental insurance (Cigna) and Vision insurance (United Healthcare)
• Paid holidays
• 401K match 6%/3%
• College tuition reimbursement program (STEAM degrees)

What’s in it for you:

At Spearhead Technology, we prioritize your well-being and professional growth. Here's what you can expect:

• Achieve a healthy work-life balance.
• Competitive compensation and abundant growth opportunities.
• Enjoy a standard 5-day workweek with 2 fixed weekly offs.
• Experience an employee-centric environment with supportive policies.
• Benefit from family-friendly and flexible work arrangements.
• Access our Performance Advancement and Career Enhancement (PACE) initiative and discover opportunities for both personal and professional growth.

Please note:

At Spearhead Technology, we value the importance of collaboration, learning, and fostering connections with clients, peers, leaders, and communities. While some in-person engagement may be required for certain roles, we are committed to providing flexibility to accommodate your individual work-life balance needs.

As an equal opportunities’ employer, Spearhead Technology welcomes and encourages applications from all members of society. We are dedicated to creating an inclusive environment where diversity is celebrated, and individuals are valued for their unique perspectives and contributions. We do not discriminate on the basis of race, religion or belief, ethnicity, disability, age, citizenship, marital or civil partnership status, sexual orientation, or gender identity.