Application Security Architect @ Veeva Systems

Veeva Systems is a mission-driven organization and pioneer in industry cloud, helping life sciences companies bring therapies to patients faster. As one of the fastest-growing SaaS companies in history, we surpassed $2B in revenue in our last fiscal year with extensive growth potential ahead.

At the heart of Veeva are our values: Do the Right Thing, Customer Success, Employee Success, and Speed. We’re not just any public company – we made history in 2021 by becoming a public benefit corporation (PBC), legally bound to balancing the interests of customers, employees, society, and investors.

As a Work Anywhere company, we support your flexibility to work from home or in the office, so you can thrive in your ideal environment.

Join us in transforming the life sciences industry, committed to making a positive impact on its customers, employees, and communities.

The Role

As an Application Security Architect, you will provide guidance and direction to software engineering teams throughout Veeva and drive the implementation of security best practices into the software development lifecycle. Establish architecture standards and patterns, and perform architecture reviews against frameworks such as BSIMM, Stride, MITRE, CIS, and others.

The security architect will work with other security leads to define the org’s security program, measure adherence, suggest/implement changes, and present to steering committees and engineering teams. We partner closely with engineering teams and other security teams to build a consolidated roadmap of security improvements. We work with engineering teams during design to build secure services, conduct security architecture reviews of the application stack, including applications built on cloud and emerging technologies, provide SME support, security guidance and mentoring, and help others evaluate new platforms, technologies, and patterns. As an architect, you will also be working with other architects and engineers to design/develop tooling and framework components to allow easy adoption of security best practices e.g., auth, transport encryption, and tracing.

What You’ll Do

Build strong relationships and effectively influence product engineering
Translate security risks to business impact
Architects, prioritizes, coordinates, and communicates the choice of security technologies necessary to ensure a highly secure yet usable computing environment
Provide security architecture and advice in support of application development, infrastructure, and enterprise technology projects
Perform code analysis, application security reviews, and develop an application security training program
Stay current with security technologies and make recommendations for use based on business value
Maintain expert knowledge in the field of Information Security and the related issues, systems, processes, products, and services
Provide training and mentoring to clients and consulting resources

Requirements

Understanding of the OWASP Top 10 application security risks and how to address them
Working knowledge of the Microsoft Security Development Lifecycle (SDL), OWASP Software Assurance Maturity Model (SAMM), or Building Security in Maturity Model (BSIMM)
Working knowledge of Amazon AWS, Microsoft Azure, or other cloud computing platform offerings and security-related services
Integration of security tools through API’s, webhook, or other custom integration
Hands-on experience with encryption, hashing, secure random number generation, key derivation, key management, digital signatures, etc. in one or more major development languages
Core understanding of web application security scanning software and related penetration testing tools such as SAST/DAST/IAST/SCA
Deep understanding of service-oriented architecture, building internet-scale, distributed, and critical services
Extensive knowledge of Java and the Java Ecosystem
Proficiency in Python, JavaScript, and other scripting languages
Experience with architecture and security reviews, threat modeling applications, and identifying areas of risk
Experience implementing strategies to support secure and compliant architectures
Knowledge of network architectures, topologies, and concepts (Firewalls, LB, WAF, CDN, VPC, ACL, TLS, SSH, and DNS)
Excellent written and verbal communication
Ability to scale by evangelizing your work to leadership and engineers including writing requirements and solid technical guides
Familiar with compliance regulations like; PCI, GDPR, SOC2, SOX
An affinity and experience with an automation and development-based approach to security
Ability to collaborate with multi-functional teams located in different time zones to drive fixes and alignment to established policies
BS in Computer Science or Equivalent with 10+ years of experience

Nice to Have

MS in Cyber Security, Information Security, MIS, or equivalent
Knowledge of the MITRE ATT&CK Framework
Industry security certifications such as CISSP, CEH, or others
Experience in conducting social engineering-focused assessments
Experience in CTF competitions, CVE research, and/or Bug Bounty recognition
Experience in Web and Mobile (Android/iOS) based application/service assessment
Experience in Wireless and Network assessment in enterprise infrastructure
Experience in reverse engineering and associated tooling such as IDA
Knowledge of fuzzing, memory corruption, and exploit development
Knowledge about hardware hacking

#RemoteUK

Veeva’s headquarters is located in the San Francisco Bay Area with offices in more than 15 countries around the world.

Veeva is committed to fostering a culture of inclusion and growing a diverse workforce. Diversity makes us stronger. It comes in many forms. Gender, race, ethnicity, religion, politics, sexual orientation, age, disability and life experience shape us all into unique individuals. We value people for the individuals they are and the contributions they can bring to our teams.

What You’ll Do

Requirements

Nice to Have

6 month growth

1 year growth

2 year growth

Benefits