Security Engineer
Toshiba Global Commerce Solutions is seeking a Cybersecurity Engineer to join a high-performing team developing and deploying software solutions for the retail industry. In this role, the engineer will be a member of the Toshiba Product Security team, assisting security architects, software developers, and cloud operations engineers in day-to-day activities and helping automate repeatable security processes, including integrating security tools into CI/CD pipelines and other systems. The Cybersecurity Engineer will help implement and update security tooling, review vulnerability scan and risk assessment reports for completeness, and support software supply chain security efforts such as maintaining Software Bills of Materials (SBOMs). Other duties include assisting with security architecture reviews and documenting security issues, researching information security topics, tools, techniques, and threats as directed, documenting information security processes under general direction, monitoring existing tickets and assisting with their resolution, and performing other related duties as required or assigned. The ideal candidate knows how to find answers and understands the available tools and resources needed to determine correct answers to security issues.
Required Skills:
- Computer Science/Software Engineering/Cybersecurity degree or equivalent combination of education, professional certifications, and work experience in the information security area.
- Understanding of information security principles, current threats, and secure software development lifecycle (SDLC) practices.
- Knowledge of common cybersecurity frameworks, standards, and tools (e.g., NIST CSF 2.0, NIST SSDF, OWASP, CIS Controls).
- Ability to work in a fast-paced, team-based environment, including collaboration with distributed teams.
- Effective verbal and written communication; able to read, write, and speak English proficiently.
Preferred Skills:
- Relevant cybersecurity certifications such as CompTIA Security+, GIAC, CSSLP, or CISSP.
- Hands-on experience with security testing tools (SAST, DAST, SCA), as well as secrets, container image, and infrastructure-as-code (IaC) scanning, ideally integrated into CI/CD pipelines.
- Experience in the application and API security domain (e.g., OWASP Top 10, OWASP API Security Top 10), including awareness of AI/LLM-specific risks.
- Programming and scripting experience (e.g., Python, PowerShell, Bash), including working with REST APIs and Git.
- Experience in cloud security (AWS, Azure, or GCP) and containerized environments (Docker, Kubernetes).
- Familiarity with software supply chain security, including SBOMs (CycloneDX, SPDX) and open-source dependency management.
- Familiarity with security requirements relevant to retail software, such as PCI DSS v4.x, the PCI Secure Software Standard, or the EU Cyber Resilience Act (CRA).
Responsibilities:
- Automating repeatable security processes using scripts and workflow tools.
- Integrating security tools with CI/CD pipelines, ticketing, and other systems.
- Implementing and maintaining the Product Security tooling.
- Reviewing vulnerability scan results and risk assessment reports for completeness, triaging findings by risk (e.g., CVSS, EPSS, CISA KEV), and tracking remediation with development teams.
- Helping generate and maintain SBOMs and monitor third-party and open-source components for new vulnerabilities.
- Assisting with security architecture reviews and threat modeling, including for AI-enabled features, and documenting security issues.
- Supporting product vulnerability handling and coordinated disclosure (PSIRT) processes, including responses to customer security questionnaires.
- Researching information security topics, vulnerabilities, mitigation techniques, tools, and threats.
- Documenting information security policies and procedures, and helping prepare evidence for audits and compliance assessments.
- Conducting periodic access control reviews and assessments.
- Conducting security testing of applications, APIs, and environments.
- Monitoring existing tickets and assisting with resolution.
- Participating in the design, development, implementation, testing, and maintenance of systems supporting a variety of applications and business-critical functionality.
- Working directly with agile development teams and stakeholders to help with existing requirements, adhere to timelines, and meet deliverables.