DirectJobHub
Jobs · Virginia

Chief Information Security Officer (83285)

CyberJobs.Com · Reston, VA · 1 mo ago
$164k–$222k/yrFull-time
We need to output HTML fragment with sections: About the role? The posting includes introductory paragraph about Verisign and role description. We need to use

for section headings: About the role, Responsibilities, Requirements, Qualifications, Skills, Benefits, Pay, Schedule. Only include sections when posting has real specific content. We need to preserve all substantive info, not invent or summarize away detail. Remove boilerplate: cookie/navigation/legal/EEO/equal-opportunity/scam-warning boilerplate, duplicated lines, application instructions. We need to include sections only when posting has real specific content. Let's parse content: - Intro: "Verisign helps enable the security, stability, and resiliency of the internet. We are a trusted provider of internet infrastructure services for the networked world and deliver unmatched performance in domain name system (DNS) services. We are a mission focused, values driven company where each individual can contribute to building a stronger, more secure internet. We offer a dynamic and flexible work environment with competitive benefits and the ability to grow your career. The Senior Application Security Engineer will play a lead role in securing all software built and/or used by Verisign. The engineer will work with application development teams as well as 3rd party organizations to ensure that security, privacy, and compliance are built into applications from design through production. The engineer should be a technical leader helping determine the future of the application security program and actively participating in a broad spectrum of activities by leading assessments, following security research and best practices, and helping set the standards of the program. The individual should possess strong interpersonal skills, be highly motivated, results oriented, have excellent communication and presentation skills, and be a strong team player." That's about the role. Could be "About the role". We'll put that as

About the role

with

containing that paragraph(s). Might need to split into multiple paragraphs? We'll keep as one

. Then "Responsibilities" heading with bullet list of responsibilities. List items: "Serve as the application security subject matter expert for development teams during requirement, design, and architecture phases, including application threat modeling for new and significantly changed applications", "Perform and lead deep dive manual and automated application vulnerability assessments, documenting findings, and provide clear remediation guidance to the responsible engineering teams", "Own the application security vulnerability management lifecycle across the security toolchain, including software composition analysis, static and dynamic testing, interactive testing, secrets scanning", "Review and provide remediation guidance for submissions from Verisign’s public Bug Bounty program", "Track open issues against defined SLAs, follow up with development teams, and escalate overdue items to engineering and InfoSec leadership", "Provide guidance to support integration of security testing into CI/CD pipelines", "Review third party and vendor supplied applications against internal security requirements", "Mentor junior engineers and analysts, review peer work, and provide constructive feedback", "Contribute to Information Security standards, secure coding guidance, and be an active participant in the broader Verisign technical community", "AI And Application Security Assess applications that embed large language models or other AI services for risks such as prompt injection, sensitive data exposure, insecure output handling, and over permissioned agents and integrations", "Develop and maintain internal guidance for developers using AI coding assistants, including expectations for review, testing, and scanning of AI generated code", "Evaluate and pilot AI assisted capabilities within the application security workflow such as finding triage, false positive reduction, and remediation guidance", "Track developments in AI security guidance and standards and translate them into practical internal requirements and guidance" We need to ensure each bullet is

  • . Then "Key Skills And Experience" heading: maybe "Requirements" or "Qualifications" or "Skills". The posting has "Key Skills And Experience" and "Preferred Skills And Experience". We need to decide which sections to include: Requirements, Qualifications, Skills, Benefits, Pay, Schedule. We have content for Skills: both required and preferred. Could combine into Skills section. Or separate Requirements (must have) and Preferred Skills (nice-to-have). The instruction: use headings for section headings (e.g. About the role, Responsibilities, Requirements, Qualifications, Skills, Benefits, Pay, Schedule). We can include multiple of those if content exists. We have specific required skills: "10+ years’ experience in Information Technology, including hands on application development experience", "6+ years’ experience conducting application security assessments using COTS and open-source tooling (Burp Suite, Fortify, or equivalent)", "Hands-on experience with software composition analysis, dynamic application security testing, and secrets scanning platforms", "Experience running a vulnerability management program through ticketing and workflow systems, including SLA definition and executive level reporting", "Strong working knowledge of the OWASP Testing Framework and OWASP Top 10", "Proficiency in currently accepted software development life cycles and associated standards and procedures", "Knowledge of current application architectures (Single Page Application, 3 tier, microservices, containerized workloads)", "Practical familiarity with AI and LLM application security risks and current industry guidance in that area", "Methodical and organized, able to manage multiple opportunities, projects, and partners concurrently", "Able to multitask and work independently with minimum supervision to meet firm deadlines", "Excellent communication, presentation, and leadership skills, including the ability to present to senior technical and non-technical audiences" Preferred: "6+ years software development using Java, C++, Rust, Go and/or scripting languages such as Python or Perl", "Experience implementing security assessments within a Continuous Integration pipeline", "Advanced experience with Linux operating systems, high comfort level with working at the command line", "Understanding of Agile methodologies (Kanban, Scrum, pair programming, etc.)", "Understanding of DevOps and security integration", "Experience with API security testing", "Experience running or supporting a public or private bug bounty program" We could put required under "Requirements" and preferred under "Preferred Skills" but heading list includes Skills. Could do "Requirements" for required, "Skills" for preferred? Or combine both under "Skills". The instruction: "Prefer a few substantive sections over many thin ones." So maybe combine required and preferred into a single "Skills" section with two sub-lists? But we must use
    • for any list of duties/requirements/benefits. Could have nested lists? Probably okay to have separate
        for required and preferred within Skills section, each preceded by a

        describing. But we also have "Pay" and "Schedule": posting includes "This position is based in our Reston, VA office and offers a hybrid work schedule. The pay range is $164,300 - $222,300. The anticipated annual base salary range for this position is noted above, however, base pay offered may vary depending on job-related knowledge, skills, experience. Verisign offers a discretionary bonus which is based on individual and company performance, and certain roles may be eligible for discretionary stock awards." Thus we have Pay and Schedule content. Schedule: hybrid work schedule. Pay: range and bonus/stock awards. Benefits: The posting mentions "competitive benefits" earlier but not specific. No detailed benefits listed. So we should not create Benefits section because no specific content. The instruction: never create Pay/Schedule/Benefits sections unless posting actually states them. It does state Pay and Schedule, so include those. Benefits not detailed, so omit. Now "Qualifications": Could be same as Requirements? Might be redundant. We could use "Requirements" for required experience/skills, and "Qualifications" for education? Not present. So maybe skip Qualifications. We need to avoid repeating job title as heading. Already not. We need to remove boilerplate: EEO statement, privacy notice, staffing agency policy, etc. Also remove duplicated lines. We need to output only HTML fragment. Let's craft:

        About the role

        Verisign helps enable the security, stability, and resiliency of the internet. We are a trusted provider of internet infrastructure services for the networked world and deliver unmatched performance in domain name system (DNS) services. We are a mission focused, values driven company where each individual can contribute to building a stronger, more secure internet. We offer a dynamic and flexible work environment with competitive benefits and the ability to grow your career. The Senior Application Security Engineer will play a lead role in securing all software built and/or used by Verisign. The engineer will work with application development teams as well as 3rd party organizations to ensure that security, privacy, and compliance are built into applications from design through production. The engineer should be a technical leader helping determine the future of the application security program and actively participating in a broad spectrum of activities by leading assessments, following security research and best practices, and helping set the standards of the program. The individual should possess strong interpersonal skills, be highly motivated, results oriented, have excellent communication and presentation skills, and be a strong team player.

        Responsibilities

        • Serve as the application security subject matter expert for development teams during requirement, design, and architecture phases, including application threat modeling for new and significantly changed applications
        • Perform and lead deep dive manual and automated application vulnerability assessments, documenting findings, and provide clear remediation guidance to the responsible engineering teams
        • Own the application security vulnerability management lifecycle across the security toolchain, including software composition analysis, static and dynamic testing, interactive testing, secrets scanning
        • Review and provide remediation guidance for submissions from Verisign’s public Bug Bounty program
        • Track open issues against defined SLAs, follow up with development teams, and escalate overdue items to engineering and InfoSec leadership
        • Provide guidance to support integration of security testing into CI/CD pipelines
        • Review third party and vendor supplied applications against internal security requirements
        • Mentor junior engineers and analysts, review peer work, and provide constructive feedback
        • Contribute to Information Security standards, secure coding guidance, and be an active participant in the broader Verisign technical community
        • Assess applications that embed large language models or other AI services for risks such as prompt injection, sensitive data exposure, insecure output handling, and over permissioned agents and integrations
        • Develop and maintain internal guidance for developers using AI coding assistants, including expectations for review, testing, and scanning of AI generated code
        • Evaluate and pilot AI assisted capabilities within the application security workflow such as finding triage, false positive reduction, and remediation guidance
        • Track developments in AI security guidance and standards and translate them into practical internal requirements and guidance

        Requirements

        • 10+ years’ experience in Information Technology, including hands on application development experience
        • 6+ years’ experience conducting application security assessments using COTS and open-source tooling (Burp Suite, Fortify, or equivalent)
        • Hands-on experience with software composition analysis, dynamic application security testing, and secrets scanning platforms
        • Experience running a vulnerability management program through ticketing and workflow systems, including SLA definition and executive level reporting
        • Strong working knowledge of the OWASP Testing Framework and OWASP Top 10
        • Proficiency in currently accepted software development life cycles and associated standards and procedures
        • Knowledge of current application architectures (Single Page Application, 3 tier, microservices, containerized workloads)
        • Practical familiarity with AI and LLM application security risks and current industry guidance in that area
        • Methodical and organized, able to manage multiple opportunities, projects, and partners concurrently
        • Able to multitask and work independently with minimum supervision to meet firm deadlines
        • Excellent communication, presentation, and leadership skills, including the ability to present to senior technical and non-technical audiences

        Skills

        Preferred skills and experience:

        • 6+ years software development using Java, C++,

    • Similar jobs