Senior Application Security Engineer

As a Senior Application Security Engineer at Genius Sports, your main responsibilities include creating and implementing security practices within our Software Development Life Cycle (SDLC), conducting security assessments, and working closely with teams to improve our cloud and Kubernetes security posture. You’ll be involved in threat modeling, security code reviews, and developing internal tools to enhance security. Additionally, you’ll conduct training sessions for engineers to cultivate a culture of secure coding.

To be a candidate for the Senior Application Security Engineer position at Genius Sports, you should have extensive experience with Kubernetes security, knowledge of secure coding practices, and familiarity with programming languages such as Java, Python, or C#. Strong analytical skills and the ability to mentor others are also necessary. A deep understanding of cloud security frameworks and compliance with standards like ISO 27001 and SOC 2 will further strengthen your application.

At Genius Sports, we actively promote a culture of security by involving our engineering teams in threat modeling exercises, conducting regular security training workshops, and integrating security tooling within our CI/CD pipelines. As a Senior Application Security Engineer, you’ll be instrumental in this process, creating educational materials and guiding teams in identifying and mitigating risks throughout the project lifecycle.

In your role as a Senior Application Security Engineer at Genius Sports, you will work with a variety of security tools designed for assessing vulnerabilities, conducting security code reviews, and facilitating secure deployments. This includes setting up and managing CI/CD for security tools and conducting assessments on hardware and software systems. Your expertise will help ensure that our infrastructure is solid and our services are secure.

The salary range for the Senior Application Security Engineer position at Genius Sports is between $165,000 and $185,000 per year. In addition to a competitive salary, we offer comprehensive health insurance, skills training, social events, and a dynamic work environment. Our commitment to diversity and inclusion means that all employees feel valued and empowered.

Discuss your background with Kubernetes, focusing on specific security measures you have implemented, such as auditing deployments against CIS benchmarks or managing vulnerabilities. Highlight your ability to work in a collaborative environment with DevOps teams and your understanding of secure architecture within Kubernetes.

Explain how you engage with development teams to ensure security is considered at every stage of the SDLC, from planning and design to testing and deployment. Cite specific examples where you've implemented secure coding guidelines or conducted threat modeling exercises.

Share a specific incident where you detected a vulnerability in a system or application. Describe the steps you took to communicate this to the relevant teams, the remediation strategies you employed, and the overall impact on the organization.

Talk about the programming languages you are proficient in (like Java, Python, or C#) and provide examples of how you've used them to build security tools or improve security features within applications. Discuss any coding standards or secure coding practices you adhere to.

Outline your method for conducting threat modeling, including how you identify potential threats and your process for evaluating risks. Provide examples of successful threat modeling sessions with cross-functional teams and the outcomes achieved.

Discuss various security assessment tools you are familiar with, explaining how you select them based on the specific security needs of a project or organization. Mention any experience you have in setting up and managing security tools within CI/CD pipelines.

Share your strategies for staying current, such as following security blogs, participating in webinars, or being involved in security communities. Emphasize your commitment to continuous learning and applying new knowledge to improve security practices.

Discuss your understanding of secure coding principles, like input validation, output encoding, and avoiding common vulnerabilities. Provide examples of how you have implemented these principles in your previous work.

Describe your approach to mentorship, emphasizing the importance of fostering an open dialogue about security. Provide examples of past experiences where you conducted workshops or one-on-one training sessions to improve the security knowledge of software engineers.

Highlight your familiarity with cloud security frameworks such as the AWS Well-Architected Framework or the Cloud Controls Matrix. Discuss how you’ve applied these principles within cloud environments to enhance security and compliance.