Security Risk Assessment

Security Risk Assessment Engineer Jobs

3 jobs found

Today

Sr Prin Security Engineer

Consumers Energy Jackson, MI

Jackson, MI

Today

Full time Senior Application Security Cloud Platforms

Apply Now

Job Description

Join Consumers Energy to support critical security initiatives as a senior technical and strategic leader.

Responsibilities

Architect, implement, operate, and maintain comprehensive security solutions for systems, networks, and applications, improving resilience against emerging threats.
Lead and participate in complex incident response and problem-solving efforts; coordinate across teams to analyze root causes, mitigate impacts, and drive long-term corrective actions.
Develop and optimize security controls by implementing technologies and process improvements aligned to business objectives and security requirements.
Evaluate and deploy security tools and platforms across one or more domains: Identity Services, Automation, Network Security Services, Security Engineering, Application Security and Penetration Testing, Vulnerability Management to strengthen visibility, detection, and response.
Provide leadership, guidance, and mentorship to other cybersecurity professionals, including Associate Engineers and Career Engineers.
Conduct threat modeling and risk assessments to identify vulnerabilities, recommend mitigation approaches, and design effective security controls.
Collaborate with cross-functional teams (Development, Information Technology, and business stakeholders) to embed security best practices across the system lifecycle.
Stay current on emerging threats, vulnerabilities, and technologies and provide strategic recommendations to strengthen the organization’s security posture.
Automate security processes using scripting languages and SOAR platforms to improve efficiency and consistency in incident response and vulnerability management.
Lead design, implementation, and continuous improvement of enterprise Identity and Access Management (IAM) capabilities, including authentication, authorization, provisioning, and identity lifecycle management.
Act as a subject matter expert for IAM platforms, governance processes, access controls, and identity security best practices.
Lead complex IAM initiatives including system integrations, platform enhancements, automation efforts, and identity governance improvements.
Perform other non-essential duties as assigned based on business needs.

Requirements

Excellent written and verbal communication skills; ability to influence technical and non-technical stakeholders.
Strong leadership and mentoring capabilities focused on team development and organizational success.
Demonstrated collaboration skills and professional standards described as humble, hungry, and people-smart.
Expert-level knowledge of security architectures, technologies, and defensive strategies.
Subject matter expertise in at least two domains: Identity Services, Automation, Network Security Services, Security Engineering, Application Security and Penetration Testing, Vulnerability Management.
Advanced troubleshooting and analytical abilities to navigate complex systems and resolve critical issues efficiently.
Strong strategic thinking and decision-making, particularly in high-pressure, fast-changing environments.
Bachelor’s degree in Cybersecurity, Computer Science, Information Technology, or a related field, plus 10+ years hands-on experience in IT, cybersecurity, computer networking, or systems engineering.
Practical experience (4–7 years) with technologies including: AAA Services, Active Directory, Application Control, Asset Discovery and Inventory Management, Azure Active Directory (Azure AD), CI/CD platforms, DDoS protection, Data Loss Prevention (DLP), Dynamic Application Security Testing (DAST), Email Security, Endpoint Detection and Response (EDR), Firewalls, Infrastructure-as-Code (IaC) Security, Logging and Monitoring Solutions, and Multi-Factor Authentication (MFA).
OR Associate degree in the related fields with 12+ years of experience as outlined above.
OR High school diploma or GED with 14+ years of experience as outlined above.

Technologies

AAA Services
Active Directory
Application Control
Asset Discovery and Inventory Management
Azure Active Directory (Azure AD)
CI/CD platforms
DDoS protection
Data Loss Prevention (DLP)
Dynamic Application Security Testing (DAST)
Email Security
Endpoint Detection and Response (EDR)
Firewalls
Infrastructure-as-Code (IaC) Security
Logging and Monitoring Solutions
Multi-Factor Authentication (MFA) Technologies
Network Access Control (NAC)
Networking Protocols
Scripting Languages
Security Orchestration, Automation, and Response (SOAR) platforms
Software Composition Analysis (SCA)
Secure Development Practices
Security Assessment and Testing
Security Configuration Assessment
Single Sign-On (SSO)
Static Application Security Testing (SAST)
Threat Intelligence
Vulnerability Management
Virtual Private Networks (VPNs)
Web Proxy technologies

Benefits

Competitive compensation packages
Medical, Dental and Vision
401k with company match
Paid parental leave
Up to 13 paid Holidays
Paid time off
Educational Assistance Program

Location

Hybrid (virtual/onsite) role with required onsite days on Monday, Tuesday, and Thursday at One Energy Plaza in Jackson, MI.
Candidate must be within commuting distance or willing to relocate (relocation package available for those that qualify).

Immigration Sponsorship

This position is not eligible for immigration sponsorship (e.g., H-1B, TN, etc.).
Do not apply if you will need immigration sponsorship for a work visa now or in the future, including H-1B or TN.
Unable to hire individuals with CPT, OPT, or STEM OPT for this position, as it is not eligible for H-1B lottery participation and is not eligible for current or future immigration sponsorship.

Diversity, Equity & Inclusion

CMS Energy values Diversity, Equity, and Inclusion and treats employees with respect and fairness.
Employee Resource Groups include Women in Energy (WE), Minority Advisory Panel (MAP), Pride Alliance of Consumers Energy (PACE), GENERGY (Different Generations), capable (Different Abilities), Interfaith, People Planet Partners, and Veterans Advisory Panel (VAP).
Company culture values: Caring, Empowered, Deliberate, Agility, Ownership.

Job Segment

Computer Science, Developer, Testing, Equity, Systems Engineer, Technology, Finance, Engineering

View full job page →

8d ago

Security Engineer (Application Security)

Blue Cross Blue Shield Association Chicago, IL

Chicago, IL

8d ago

$119k - $172k/yr Full time Application Security Cybersecurity Tools Information Security

Apply Now

Job Description

The Security Engineer in Application Security will apply application security engineering, assessment, and secure software development practices across cloud-native, web, API, containerized, and microservices-based applications. The role partners with architects and stakeholders to support application security roadmaps, operational excellence, risk management, cost optimization, and incident response readiness within an application security domain.

Location and Work Arrangement

Chicago, IL (hybrid)

Compensation

USD 118,500 - 171,825 per year

Core Responsibilities

Collaborate with Architects and key stakeholders within a defined security domain or program, contributing to multiple related projects.
Lead development of comprehensive roadmaps across multiple projects or departments.
Drive operational excellence through process improvement initiatives that support security execution.
Identify and implement strategic savings opportunities to support cost optimization efforts.
Improve security risk visibility by developing and overseeing robust risk management frameworks.
Support domain-related incident response efforts as needed, while maintaining defined security architecture and managing domain-specific security tools.
Apply application security engineering, assessment, and secure software development practices across cloud-native, web, API, containerized, and microservices-based applications.
Support the application vulnerability assessment lifecycle and integrate security controls and testing throughout the software development lifecycle and DevSecOps pipelines.

Required Qualifications

Bachelor’s Degree in Computer Science, Information Security, or a related field, or equivalent work experience.
5+ years of cybersecurity experience, with preferred focus on application security, vulnerability assessments, and secure software development practices.
Experience applying risk remediation prioritization and collaborating with stakeholders to understand risk drivers and remediation blockers.
Experience monitoring and tracking remediation efforts, staying current on emerging threats, and designing, implementing, and maintaining domain-specific toolsets.
Hands-on experience with SAST, DAST, Software Composition Analysis (SCA), Software Bill of Materials (SBOM) analysis, API security assessments, secure code reviews, threat modeling, and risk assessments.
Experience managing the Application Vulnerability Assessment (AVA) cycle, including planning, vulnerability validation and rating, reporting, remediation guidance and tracking, and validation of fixes.
Experience assessing cloud-native, web, API, containerized, and microservices-based applications across Azure, AWS, Kubernetes, and OpenShift.
Experience working with internal and external auditors and Governance, Risk, and Compliance (GRC) teams to provide assessment evidence, address findings, and support compliance activities.
Experience with Infrastructure as Code technologies, including Terraform, Bicep, ARM Templates, YAML, Docker, Kubernetes manifests, and Helm, plus the ability to develop automation and security testing scripts.
Ability to plan, develop, implement, and update the company’s information security strategy.
Excellent communication and presentation skills for technical and non-technical audiences.
Advanced analytical and problem-solving skills with the ability to manage multiple projects, ensuring timely and budget-friendly delivery.
Effective interpersonal skills, including the ability to influence and resolve problems.
Solid understanding of HIPAA/HITRUST requirements, cloud-first security practices, and security tools and technologies.
Advanced knowledge of application security principles and standards, including OWASP Top 10, OWASP API Security Top 10, OWASP ASVS, NIST Cybersecurity Framework, HIPAA, HITRUST, FedRAMP, FISMA, FIPS, and AICPA SOC reporting requirements.
Proficiency with application security testing and assessment tools such as Burp Suite, OWASP ZAP, Checkmarx, Veracode, Fortify, GitHub Advanced Security, SonarQube, Postman, and SoapUI.
Knowledge of software supply chain, cloud, container, and vulnerability management security tools, including Snyk, Mend/WhiteSource, Black Duck, Dependabot, JFrog Xray, Cortex Cloud, Prisma Cloud, Tenable Cloud Security, Wiz, Aqua Security, Trivy, Microsoft Defender for Cloud, Tenable Vulnerability Management, Brinqa, and ServiceNow Vulnerability Response.
Knowledge of DevSecOps platforms and practices, including GitHub Enterprise, GitHub Actions, Azure DevOps, Jenkins, secure software testing, and test-driven development (TDD).
Ability to review and assess code in Python, Java, JavaScript, TypeScript, Node.js, AngularJS, C#, PowerShell, Go, SQL, Bash, and other common shell scripting languages.
Ability to identify and assess vulnerabilities such as authentication flaws, authorization weaknesses, insecure APIs, injection attacks, secrets exposure, cloud misconfigurations, and container security risks.
Ability to communicate technical findings to developers and translate risk, impact, and remediation guidance for business and non-technical stakeholders.
Ability to drive continuous improvement across application security capabilities, vulnerability management processes, remediation validation, and enterprise risk visibility.
Preferred: AI literacy, including an understanding of generative AI tools, appropriate business applications, and limitations.

Technology Focus

Cloud and platforms: Azure, AWS, Kubernetes, OpenShift
Infrastructure as Code: Terraform, Bicep, ARM Templates, YAML
Containers and orchestration: Docker, Kubernetes manifests, Helm
Security and assessment: Static Application Security Testing (SAST), Dynamic Application Security Testing (DAST), Software Composition Analysis (SCA), Software Bill of Materials (SBOM), API security assessments, secure code reviews, threat modeling, risk assessments, Application Vulnerability Assessment (AVA) cycle
Security standards and frameworks: OWASP Top 10, OWASP API Security Top 10, OWASP ASVS, NIST Cybersecurity Framework, HIPAA, HITRUST, FedRAMP, FISMA, FIPS, AICPA SOC reporting requirements
Testing and security tools: Burp Suite, OWASP ZAP, Checkmarx, Veracode, Fortify, GitHub Advanced Security, SonarQube, Postman, SoapUI
Supply chain and vulnerability tools: Snyk, Mend/WhiteSource, Black Duck, Dependabot, JFrog Xray, Cortex Cloud, Prisma Cloud, Tenable Cloud Security, Wiz, Aqua Security, Trivy, Microsoft Defender for Cloud, Tenable Vulnerability Management, Brinqa, ServiceNow Vulnerability Response
DevSecOps and software delivery: GitHub Enterprise, GitHub Actions, Azure DevOps, Jenkins, test-driven development (TDD)
Languages: Python, Java, JavaScript, TypeScript, Node.js, AngularJS, C#, PowerShell, Go, SQL, Bash

Benefits

Paid time off
11 holidays
Medical, dental, and vision insurance
401(k) matching
Lifestyle spending account
Many other benefits to eligible employees
Annual bonus incentive pay (eligible)

View full job page →

9d ago

Application Security Engineer

Tempus Chicago, IL

Chicago, IL

9d ago

$85k - $130k/yr Full time Ai Enabled Security Ai Security Application Security

Apply Now

Job Description

Tempus is seeking an Application Security Engineer in Chicago, IL to help secure the software development lifecycle end-to-end. The role partners with product and engineering teams to assess applications and cloud-hosted services, strengthen SDLC controls, and address security risks in AI and LLM-enabled systems.

Key Responsibilities

Embed security into the SDLC through threat modeling, design reviews, security requirements, and security-focused code reviews with product and development teams.
Plan and conduct application security assessments and penetration tests for web applications, APIs, and cloud-hosted services, then document findings with clear risk ratings and practical remediation guidance.
Threat model and assess AI and LLM-enabled features, including agents, RAG pipelines, and tool or MCP integrations, using adversarial prompt testing and validating guardrails, permissions, and data access controls.
Select, integrate, and tune SAST, DAST, software composition analysis, and secrets scanning in CI/CD pipelines.
Build automation and secure-by-default patterns, including guardrails that prevent whole classes of vulnerabilities.
Use AI-assisted tooling to scale code review, triage, and remediation while applying human judgment to validate results.
Reproduce, triage, and prioritize application security vulnerabilities, and work with developers through remediation.
Communicate the nature, severity, and business risk of security issues to development teams and leadership.
Design, implement, and document application security controls, standards, and secure coding guidance.
Run and support the vulnerability disclosure program.
Coach developers on secure design and coding through consulting, training, and day-to-day collaboration.

Required Qualifications

3 to 5 years of experience in application security, penetration testing, or software engineering with a security focus.
Hands-on experience testing web applications, APIs, and cloud-hosted services using proxying and penetration testing tools such as Burp Suite, with strong knowledge of common security flaws and mitigations (including OWASP Top 10).
Experience performing security design reviews at the architecture level.
Working experience securing AI and LLM-enabled applications, including how they are designed and how they fail (prompt injection, data leakage, excessive agency, insecure output handling), informed by OWASP Top 10 for LLM Applications.
Practical experience using at least one threat modeling method, such as STRIDE, PASTA, or attack trees.
Experience with SAST, DAST, and SCA tools, including integrating them into CI/CD pipelines.
Proficiency in Python, Go, or JavaScript for security tooling and automation, with the ability to read and review code.
Solid understanding of network and web protocols (TCP/IP, HTTP/S), authentication and authorization (such as OAuth/OIDC), and cryptography fundamentals.
Ability to collaborate effectively with software development teams and Product Managers.
Excellent written and verbal communication skills, including clear explanation of complex topics.

Technologies

Burp Suite, OWASP Top 10
Python, Go, JavaScript
TCP/IP, HTTP/S
OAuth/OIDC
SAST, DAST, SCA, software composition analysis, secrets scanning
CI/CD
STRIDE, PASTA
OWASP Top 10 for LLM Applications
MCP, RAG pipelines

Bonus Qualifications

Hands-on AI red teaming or security testing of agentic or RAG systems, familiarity with MITRE ATLAS or the NIST AI Risk Management Framework.
Experience with Docker, Kubernetes, GCP, or AWS, and infrastructure-as-code scanning.
Bug bounty or vulnerability disclosure program experience.
Experience with HIPAA and healthcare data protection.
Interest in working in biotech, genomics, and precision medicine.
Certifications such as GWAPT, OSCP, CSSLP, CISSP, or ISC2 CC (Certified in Cybersecurity).

Location and Compensation

Location: Chicago, IL (onsite)
Salary: USD 85,000 to 130,000 per year
Experience: Minimum 3 years

View full job page →

Security Risk Assessment Engineer Jobs

Sr Prin Security Engineer

Security Engineer (Application Security)

Application Security Engineer

Get Security Risk Assessment Engineer Jobs alerts