Director Engineering, Application Security & Red Teaming

Hybrid role in Orlando, Florida joining CT - Security at Electronic Arts. This Director-level position leads EA’s Red Team work to uncover major security threats and strengthens an enterprise-wide application security program, with an emphasis on automation and best practices. You will report into the Vice President of the Enterprise Security Team and partner closely with vulnerability management, incident response, threat hunting, and security operations teams.

What you’ll do

• Respond to emerging threats including APT and other forms of targeted attacks such as organised crime.
• Plan and conduct attacks on internally or externally hosted applications and infrastructure at a global scale, focusing on critical functions targeted by adversaries.
• Design and develop scripts, frameworks, tools, and methods to facilitate and execute application security assessments.
• Participate in attack analysis as part of security incident response to stay current on latest adversary TTPs.
• Assemble and coordinate with EA’s IR Ops and other teams to resolve security incidents quickly and efficiently.
• Communicate mission and Red Team activity status to EA Security leadership and studio leadership.
• Ensure knowledge management of findings and review results from attack campaigns to determine severity and identify remediation or mitigation strategies.
• Stay current on attack techniques and understand published and emerging real-life attack scenarios.
• Mentor and train more junior staff in attack techniques, tool and exploit development, intelligence analysis, and adversarial tactics.
• Communicate effectively with representatives from Lines of Business, technology specialists, and vendors.

Security program ownership

Beyond “classic” Red Team activities and penetration testing, this role contributes to building an application security program that scales enterprise-wide. The focus is on developing repeatable assessments and enabling teams through automation and standardized best practices.

Key skills and experience

• Experience as a strong leader and attractor of high-caliber technical talent.
• Proven ability to build relationships across the business and drive change through those relationships.
• Strong interpersonal skills, including the ability to tailor engagements for different business types and leaders.
• Track record building and delivering security programs from the ground up.
• Ability to plan quarterly roadmaps, make hard trade-offs, communicate decisions clearly, and manage reporting and business rhythm.
• Experience building and deploying flexible automation frameworks.
• Strong knowledge in at least 3 of the following (with knowledge of the remainder):

• Tools similar to Cobalt Strike, BURP, Bloodhound.
• Web Penetration Testing (injection, XSS, validation, session management, web services, etc.).
• Databases (Oracle, MSSQL, MySQL: hosting, configuration, etc.).
• Networks (protocols, traffic analysis, wireless, etc.).
• Operating Systems (UNIX, Solaris, Linux, Mac, Windows: configuration, file system, etc.).
• Development (coding, scripting, SQL, computer architecture, exploit writing, code analysis).
• Application Analysis (fuzzing, reverse engineering, disassembling such as IDA and OllyDbg).
• Crypto (password cracking, encryption, algorithm analysis).

Technologies you may work with

• Cobalt Strike, BURP, Bloodhound, IDA, OllyDbg
• Oracle, MSSQL, MySQL
• UNIX, Solaris, Linux, Mac, Windows
• SQL

Minimum experience: 3 years. Worker type: Regular Employee. Role ID: 216590.

This highly technical leadership role plays a critical part in identifying the biggest security threats to EA and supports industry-wide collaboration to help gaming companies stay focused on building amazing games while addressing real-world adversaries.