Cyber Security Engineer -- Threat Modeling
Job Description
Please find details for this position below:
\n
Client: Banking/Financial Industry
\n
Title: Cyber Security Engineer -- Threat Modeling / Threat Modeling Engineer
\n
Location: Charlotte, NC - Remote
\n
Duration: 12 months, convert to hire - No C2C
\n
\n
Critical Screening Questions and Answers: (Used by Supplier to Get Best Fit. Suppliers will provide the candidate answers to these questions as part of resume submittal to VMS)
\n
- \n
- Which threat modeling tools have you used?
- At a high level, walk through threat modeling a customer-facing banking web site?
- How do you identify and validate trust boundaries, assets, and assumptions when documentation is incomplete?
- How do you distinguish between a plausible threat scenario and a potential threat to a development team?
\n
\n
\n
\n
\n
\n
Description:
\n
Business Initiative/Purpose: (Goal, Business Impact, Accomplishments from the work)
\n
- \n
- Threat Modeling BAU tasks.
- Mature Threat Modeling practice.
- Help with pen testing as time permits.
\n
\n
\n
\n
\n
Bachelor Degree: (Required, Preferred or Not Required)
\n
- \n
- Preferred.
\n
\n
\n
Role Responsibilities: (what they will be doing)
\n
- \n
- Perform threat modeling using a TM tool, work with app teams to answer questions about their system's architecture, and provide prioritized mitigation strategies for threats and attack paths.
- During periods of lower threat modeling demand, support penetration testing program coordination activities.
\n
\n
\n
\n
Must Have Skills/Prior Experiences: (Vendor should not submit any candidate that does not have these skills/prior experience.)
\n
- \n
- Prior threat modeling and/or architecture experience.
- Comfortable with PASTA and STRIDE+P methodologies.
- Familiarity with MITRE ATT&CK.
- Able to work with app teams to explain threat modeling and its output.
\n
\n
\n
\n
\n
\n
Plus/Nice to Have Skills/Prior Experiences:(Hiring Manager DOES NOT require these skills/ prior experience. However candidates with any of these will be looked at first.)
\n
- \n
- Bank/regulated background.
- Threat model program build-out.
- Experience supporting security, risk, compliance, or audit activities.
- Experience supporting vulnerability remediation activities, preferably for penetration testing.
- Working knowledge of common application security vulnerabilities and remediation approaches.
- General understanding of application architectures and technologies.
- Project management.
\n
\n
\n
\n
\n
\n
\n
\n
\n
EEO:
\n
Mindlance is an Equal Opportunity Employer and does not discriminate in employment on the basis of – Minority/Gender/Disability/Religion/LGBTQI/Age/Veterans.