<div><span>Sonatype is the software supply chain security company. We provide the world’s best end-to-end software supply chain security solution, combining the only proactive protection against malicious open source, the only enterprise grade SBOM management and the leading open source dependency management platform. This empowers enterprises to create and maintain secure, quality, and innovative software at scale. </span></div><div><br /></div><div><span>As founders of Nexus Repository and stewards of Maven Central, the world’s largest repository of Java open-source software, we are software pioneers and our open source expertise is unmatched. We empower innovation with an unparalleled commitment to build faster, safer software and harness AI and data intelligence to mitigate risk, maximize efficiencies, and drive powerful software development. </span></div><div><br /></div><div><span>More than 2,000 organizations, including 70% of the Fortune 100 and 15 million software developers, rely on Sonatype to optimize their software supply chains.</span></div><div><br /></div><h3>About the Role</h3><ul><li>We are seeking a skilled <b>Information Security Engineer</b> to join our team and play a crucial role in securing our digital assets. This role offers an exciting opportunity to work with cutting-edge security tools, collaborate with global teams, and contribute to strengthening our cybersecurity framework.</li></ul><h3>Key Responsibilities</h3><ul><li>Conduct <b>vulnerability scans</b>, analyze results, and support remediation efforts.</li><li>Manage <b>security incidents</b>, including response, resolution, and prevention.</li><li>Proactively <b>protect digital assets</b>, mitigating risks before breaches occur.</li><li> Implement, configure, and upgrade <b>security tools and systems</b>.</li><li> Evaluate, integrate, and configure <b>security technologies</b> to enhance protection.</li><li>Collaborate with <b>technical teams, product managers, and third-party vendors</b> on security initiatives.</li><li> Respond to <b>cybersecurity alerts</b>, monitor logs, and manage security events.</li><li> Perform <b>technical risk assessments</b> on software, tools, and third-party integrations.</li><li>Identify vulnerabilities in infrastructure and provide risk-based recommendations.</li></ul><h3>What We’re Looking For</h3><ul><li><b>8+ years</b> of experience in <b>software development or security engineering</b>.</li><li><b>7+ years</b> of experience in <b>DevOps and security operations</b>.</li><li><b>7+ years</b> handling <b>incident response and escalation</b>.</li><li> Strong understanding of <b>vulnerability management and scanning tools</b>.</li><li>Familiarity with <b>common security frameworks, protection methods, and DevSecOps</b>.</li><li> Experience with <b>SAST, DAST, SCA</b>, or related security testing tools.</li><li> Hands-on experience conducting <b>security reviews</b> (architecture, source code, infrastructure).</li><li>Experience deploying <b>automated/custom vulnerability scans</b>.</li><li>Knowledge of <b>cloud and infrastructure security</b> principles.</li></ul><h3>Bonus Skills (Good to Have)</h3><ul><li>Knowledge of <b>web application security</b> (e.g., <b>OWASP Top 10</b>).</li><li> Understanding of <b>security architecture principles</b>.</li><li> Familiarity with <b>threat modeling frameworks</b> and security assessments.</li><li>Relevant <b>certifications</b> such as:</li><li><b>SANS Certifications:</b> GSEC, GCIH, GCLD, GCID, GMON</li><li> <b>(ISC)² Certifications:</b> CISSP, CC, SSCP, CCSP, CAP, CSSLP</li></ul><h3>Why Join Us?</h3><ul><li><b>Work with a global team</b> at the forefront of cybersecurity.</li><li> <b>Exciting career growth</b> opportunities with industry-leading experts.</li><li><b>Work-from-home flexibility</b> with a strong work-life balance.</li><li><b>Continuous learning &amp; certification support</b> to advance your skills.</li></ul><div>At Sonatype, we value diversity and inclusivity.  We offer perks such as parental leave, diversity and inclusion working groups, and flexible working practices to allow our employees to show up as their whole selves.  We are an equal-opportunity employer, and we do not discriminate on the basis of race, religion, color, national origin, gender, sexual orientation, age, marital status, veteran status, or disability status.  If you have a disability or special need that requires accommodation, please do not hesitate to let us know.</div><div><br /></div><div><br /></div><div><br /></div>

Sonatype

Staff Information Security Engineer

Sonatype

Similar Remote Jobs