(Sr.) Information Security Manager

Summary:

Are you passionate about revolutionizing the future of finance through blockchain technology? Join us at WSPN (Worldwide Stablecoin Payment Network, https://wspn.io/), where we're building the next generation of payment solutions. We are seeking a visionary and experienced (Sr.) information security Manager to lead the development and implementation of our information security strategy, ensuring the protection of our digital assets and compliance with industry standards. This role requires a seasoned security professional with a passion for securing and testing applications, managing vulnerabilities, and leading a team towards building a secure payment network.

Responsibilities:

Information Security Strategy and Management

• Collaborate with product management and software engineering teams during all phases of the SDLC to ensure that applications are designed and implemented securely.
• Develop, implement, and maintain the company's overall information security strategy, ensuring compliance with industry best practices and regulatory requirements.
• Create and enforce information security policies, procedures, and standards to protect the company's information assets.

Security Testing and Vulnerability Management

• Test web applications and underlying systems for vulnerabilities using both tools and manual techniques; manage the remediation of findings through resolution.
• Recommend code changes to eliminate vulnerabilities and automate security tests within the CI/CD pipeline.
• Research vulnerabilities specific to blockchain technologies and incorporate this knowledge into WSPN's security practices.

Security Training and Standards

• Help develop secure coding standards and training materials based on findings seen in WSPN’s environment to empower engineers to write more secure code.
• Serve as an escalation point to investigate security alerts and identify incidents.
• Investigate vulnerability reports related to WSPN products and systems.

Vendor Management and Project Support

• Manage vendors to conduct penetration tests and other security-related projects.
• Influence the continuous improvement of the application security program and support other security team projects such as threat modeling, vulnerability scanning, and audits.

Qualifications:

• Bachelor’s or Master’s degree in Computer Science, Computer Engineering, Cybersecurity, or a related field. Equivalent experience is also accepted.
• 7+ years of total experience in information security, 3+ years of experience as a security engineer leading projects and developing resolutions in cybersecurity.
• Experience in the blockchain technology or a passion for the blockchain industry is a must.
• Experience in financial services or financial technology is desired.
• Enthusiasm for securing and breaking software, familiar with common attack techniques and conducting penetration tests.
• Experience designing software security features including, but not limited to, access control features, logging and monitoring features, input validation, and session management.
• Experience automating security tests in CI/CD pipelines.
• Familiarity with SAST and DAST testing processes and tools, and building detections.
• Experience with cloud security tools is preferred.
• Experience with application deployments and cloud infrastructure architectures within AWS/GCP via automated deployments and Infrastructure-as-Code.
• Familiarity with Slack, Apple MacOS, and GSuite.
• Working knowledge of public and private key cryptography.
• Familiarity with techniques for making software robust against common attacks.
• Self-motivated and creative problem-solver able to work independently with minimal guidance.
• Strong ability to work collaboratively across teams.
• Ability to manage multiple competing priorities and use good judgment to establish order of priorities on the fly.
• Certifications such as CISSP, CEH, or similar are favorable but not required.
• Experience with several of the following is highly desirable: Java, Angular JS, REST APIs, JSON, and Python.
• Prior experience with threat and vulnerability management is preferred.
• Fluency in Mandarin is preferred due to interaction with stakeholders.