Software Security Architect

REMOTE – UK

PRODUCT (R&D) – ENGINEERING

FULL-TIME

Alfresco is a commercial, open source software company that provides simply a better way for people to work, ensuring they have the right information they need, exactly when they need it most.

Our software powers the daily work of more than 11 million people at industry-leading organizations in more than 190 countries worldwide. The Alfresco Digital Business Platform is a modern, enterprise-class, cloud-native platform that enables organizations to build digital operations to deliver instant services with exceptional experiences. It provides the fastest path for people to interact with information and for organizations to quickly respond to threats, opportunities and circumstances.

Alfresco helps more than 1,300 industry-leading organizations, including Cisco, Pitney Bowes, the Canadian Museum for Human Rights, US Navy Department, the Joint Chiefs of Staff, and NASA, be more responsive and competitive.

Founded in 2005, Alfresco has its headquarters in Boston, Massachusetts, USA. For more information on Alfresco, please visit http://www.alfresco.com.

The Role

Alfresco’s products and cloud services are used by the world’s largest organizations to store their most sensitive information and run their most critical business processes. Security is of paramount importance to them.

Alfresco is seeking someone who gets truly excited when talking about software security. They’ll be great at sharing their knowledge of security best practices that’s been built up over at least the last five years, and they’ll have demonstrable experience of defining and enforcing those best practices at other large software companies. This person will be hands on, working within engineering teams to help them design, build, and test secure software by showing them rather than just telling them. Because of this, the right person will be a skilled Java software engineer with deep knowledge of network security and strong scripting skills.

Friendly, outgoing, and quick to build good working relationships founded on respect, the role will involve critically reviewing engineers’ software designs and implementations against current world-class security best practices while staying constructive and supportive. The person who takes this role will be a world-class software security expert with strong emotional intelligence.

As Alfresco’s software is deployed in a range of ways, a breadth of security knowledge that encompasses containers and orchestration – including Kubernetes – as well as cloud-based infrastructure such as AWS and Azure will be needed. As technology and hackers are always changing, a desire to keep on learning is important.

If you think that this describes you, and you’d like to make a difference in an exciting open-source software company then get in touch with us. We’d love to hear from you.

Location: Preferably UK, but any considered for the best person

In this role, you’ll be accountable for achieving and maintaining these outcomes:

• All software engineers and test engineers working on Alfresco’s products and services understand how to create secure software and how to identify insecure software.
• All Alfresco software is designed to be secure and is subjected to rigorous security testing.
• There are up-to-date threat models of all Alfresco products and services.
• The security controls in Alfresco products and services are fit for purpose given the defined threat models.
• There is up-to-date documentation of all security controls used in Alfresco products and services.
• All tooling used in the creation of Alfresco products and services is secure.
• All tooling used to verify the security of Alfresco products and services is fit for purpose and used consistently.
• There is a vibrant community around security best practices within Alfresco.
• Vulnerabilities discovered in externally-sourced software used within Alfresco’s products and services are assessed promptly and assigned for fixing as needed.
• All Alfrescans know that the Software Security Architect is their point of contact for questions relating to the security of Alfresco products and services.

Basic Qualifications

• Bachelor’s Degree in Computer Science or related field.
• 3+ years of progressive security architecture experience; preferably within a professional services firm or similar environment working with startups and large security mature companies.
• 3+ years of application security experience designing, building or testing web and API-based architectures
• 3+ years of experience working with stakeholders across many functions.

Preferred Qualifications

• Understanding of security vulnerabilities, attacker exploit techniques, and methods for remediation of such.
• Capacity and tolerance for extreme context switching and interruptions while remaining productive and able to provide effective, safe guidance.
• Experience communicating technical concepts to a non-technical audience.
• Prior working experience in or with a Software Development Team.
• Demonstrated experience in areas such as system security, network, and/or application security experience.
• Understanding of best practices in one or more security engineering specialties: secure development, cryptography, network security, security operations, systems security, policy, and incident response.
• Experience developing and interpreting security compliance standards and guidance.
• Scripting skills (e.g., Python, C, C++, Java, Ruby, or PowerShell)

Alfresco is an equal opportunity employer and we value diversity at our company. We do not discriminate on the basis of race, religion, color, national origin, military status, gender, gender identity, sexual orientation, age, marital status, genetic information, medical condition or disability status.