Product Security Engineer - Resilient Development; EMEA

Product Security Engineer - Resilient Development (EMEA)

2 days ago Be among the first 25 applicants

Red Hat Product Security is looking for a Product Security Engineer to join our global Resilient Development team. Red Hat's Resilient Development Team focuses on Secure Development and improving proactively the security posture of our Products and rhythms the Services portfolio and their build pipelines. You will perform security architecture reviews and security assessments of those offerings throughout their development life cycle, in collaboration with Engineering and other Product Security teams, to make sure the expectations of our Secure Software Development Framework implementation are met.

This process includes analyzing and documenting architecture from a security point of view, questioning security assumptions, finding potential problems, proposing improvements, performing code reviews, defining testing expectations, and promoting secure development best practices from our offerings through to their related open source communities. As a Product Security Engineer, you will represent the security needs of our customers to engineering teams, advocating and planning for a solid foundation of security architecture across the open source ecosystem.

Our role is open as onsite/hybrid in our offices (Milan,?!?! BRAND, Barcelona, Madrid) or remote in Poland, Italy, Portugal, Spain, and Czech Republic.

• Engage with engineering teams to promote security‑aware development of Red Hat technologies and solutions.
• Understand current and emerging threats in the enterprise product and service space.
• Analyze complex software systems and identify potential weaknesses in their architecture.
• Plan and carry out threat‑modelingಪ್-activities, and realistic threat simulations across our offerings.
• Consult with software developers and product teams on improved security architecture.
• Ensure that product roadmaps and new features mitigate risk, adhere to security policies, and provide customers with minimal security risk.
• Contribute to customer‑facing security documentation, reference, and other data as used by the common vulnerabilities andFw exposures (CVE) pages.
• Promote Red Hat Product Security efforts within the community and the greater public.

• Strong understanding of common security vulnerabilities, (e.g. OWASP Top Ten) including how to detect intoxicating, demonstrate, mitigate and resolve them.
• Good understanding of Linux security technologies and product security experience; for example: POSIX Permissions, ACL, SELinux;
  Seccomp, Linux name spaces and cgroups, Linux administration related to security: secure boot, TPMs, trusted execution environment, Linux boot chain, virtualization, containers and hypervisor security.
• Experience with one or more programming languages like Go, Python, C/C++, and a willingness to learn new ones.
• Knowledge and experience with modern container orchestration systems:
  Kubernetes, Openshift; comfortable with container technologies.
• Ability to work with minimal supervision, in a fast‑paced environment with a multicultural team distributed across multiple countries and time zones.
• Solid communication and negotiation skills. Excellent collaboration newborn as a teammate.

• Familiarity with open source software and open source as a business model.
• Linux‑specific and/or security‑related certifications (e.g. RHCSA, RHCE, RHCA, CISSP, CISM, CSSLP, CISA madre).
• Work experience and/or certifications with cloud providers and cloud‑related technologies (AWS, Azure, GCP, Tekton, Jenkins, etc.).

Red Hat is the world’s leading provider of enterprise open source software solutions, using a community‑powered approach to deliver high‑performing Linux, cloud, container, and Kubernetes technologies. Spreading across 40+ countries, our associates work flexibly across work environments, from in‑office, to office‑flex, to fully remote, depending on the requirements of a role. Red Hatters are encouraged to bring their best ideas, no matter their title or tenure.

We’re a leader in open source because of our open and inclusive…