About us:

LogRhythm, a Thoma Bravo company, empowers more than 4,000 customers across the globe to measurably mature their security operations program. LogRhythm’s award-winning NextGen SIEM Platform delivers comprehensive security analytics; user and entity behavior analytics (UEBA); network detection and response (NDR); and security orchestration, automation, and response (SOAR) within a single, integrated platform for rapid detection, response, and neutralization of threats. Built by security professionals for security professionals, LogRhythm enables security professionals at leading organizations like NASA, XcelEnergy, and Temple University to promote visibility for their cybersecurity program and reduce risk to their organization each and every day. LogRhythm is the only provider to earn the Gartner Peer Insights Customers’ Choice for SIEM designation three years in a row.  

Who we are looking for:

LogRhythm is seeking an Application Security Architect that will lead the design and implementation of application security architecture, infrastructure, and processes to align to our company and product needs.  You will be responsible for ensuring LogRhythm products adhere to corporate and product certification requirements, securing LogRhythm’s development and production environments, and protecting customer data.

You and your team will perform application security assessments, architecture reviews, threat modeling, code reviews, and raise developer awareness of security best practices. You will partner closely with our development teams to produce secure solutions. You will work cross functionally with your peers in the engineering organization as well as leaders in other business units. 

Here’s an overview of the responsibilities & challenges ahead:

• Develop a detailed roadmap for the security of LogRhythm’s products.  Define, plan, and measure the progress of security projects.  Report status on project progress and recommend correction as needed.
• Lead penetration testing and other regular security assessment tests of LogRhythm’s products and operational environments.  Review assessment reports and coordinate with engineering to ensure findings are remediated.
• Lead the design and implementation of the DevSecOps pipeline integrating security into the CI/CD pipeline of LogRhythm’s products. 
• Create and foster a cross-functional DevSecOps culture in developing, deploying, and monitoring complex applications and mission critical infrastructure.
• Collaborate with GRC and engineering to design and implement technical solutions to meet compliance standards (SOC2, ISO27001, GDPR, Privacy Shield, HIPAA, PCI, FedRAMP, CMMC, DISA APL, FIPS and Common Criteria, etc.).
• Ensure that security is represented throughout the product SDLC from requirements, to design, implementation, deployment and continuous monitoring in operations.
• Organize and administer security training relevant to engineers such as those based on the OWASP Top 10 Application Security Risks to raise security awareness.  Publish security standards and best practices for engineering teams.
• Be a champion of security throughout the organization by defining best practices and pushing for both technical and cultural change.
• Develop, document, implement, and enforce policies and procedures relevant to application security such as code reviews, vulnerability management, configuration management, audits, etc.
• Provide coaching and mentorship to junior team members.

About you:

• Bachelor’s degree in Computer Science, Management Information Systems, Engineering or related field, or equivalent work experience.
• 10+ years experience in Information Security Engineering, in a mix of both technical and management capacity.
• Previous success in building effective collaboration between AppSec and Engineering teams.
• Deep understanding of web application architecture and design principles
• Direct experience performing security design reviews for complex applications, including distributed systems, APIs, and services deployed to cloud, on-premise, and hybrid environments
• Previous experience with penetration testing web-based SaaS applications and systems operating out of Cloud infrastructure (AWS, GPC, Azure, etc.).
• Previous experience in software engineering, secure coding best practices, and security code reviews in at least one of the following: Java, JavaScript, Go, C#, Python.
• Understanding of compliance standards and how they impact software products and cloud operations.
• Contributions to the security community a plus: research papers, public CVEs, conference talks, open source, etc.
• Security and project management certifications a plus: CISSP, CISM, PMP, etc.

Salary and Other Compensation;        

• The annual starting salary for this position is between $175,000- $225,000 depending on experience and other qualifications of the successful candidate.

Benefits:

LogRhythm offers the following benefits for this position, subject to applicable eligibility requirements;

• Medical
• Vision
• Dental
• HSA
• FSA
• 401k plan
• Flexible time off
• Employee assistance program
• Employees are eligible to receive incentive units

Additional information;

• Created:/ Revised Date: - 5th February 2021
• Reporting to: - Director of Security/Deputy CISO
• Location: - Boulder, Colorado (will consider US remote working)
• Employment Status: - Full Time
• FLSA/ Applicable State Law Status- Except

Workplace equality & inclusion are not just words or topics for LogRhythm, they are part of our core values, beliefs, and integral to our company culture. We hire the best of the best and do not discriminate based on race, gender, age, religion, sexual orientation, identity, or other personal factors. LogRhythm was built on the principals of innovation, dedication, creativity, and commitment. It is through these key areas we were able to grow as an equal and inclusive workplace, one where our employees feel respected and safe in.

Disclaimer: The salary, other compensation, and benefits information is accurate as of the date of this posting. The company reserves the right to modify this information at any time, subject to applicable law.