Description
HP Wolf Security is seeking a Principal Security Software Engineer to lead improvements to Wolf Security's secure software development processes. The successful candidate will help strengthen security engineering practices, ensuring security is built into every stage of the software development lifecycle.
Responsibilities:
- Lead the definition and delivery of improvements to Wolf Security's secure software development lifecycle in line with European Union Cyber Resilience Act (CRA) expectations.
- Introduce better static analysis tools, improve their integration into development and build workflows, tune rules and policies, and help teams resolve the issues they identify.
- Establish approaches for triaging findings, managing false positives, tracking remediation, and measuring security improvement.
- Promote security-by-design and secure-by-default principles through threat modelling, design reviews, architectural guidance, and secure coding practices.
- Improve the identification, assessment, documentation, and remediation of vulnerabilities throughout the software development lifecycle.
- Provide technical leadership on complex security problems, make engineering trade-offs, and mentor engineers through constructive review.
Requirements:
- Significant experience building, securing, and maintaining production software, ideally endpoint, security, or systems software.
- Strong programming experience in C, C++, Rust, Python, PowerShell, or comparable languages.
- Experience developing software for Windows and/or Linux, including operating-system, virtualisation, isolation, or other security-sensitive components.
- Strong experience with code review, debugging, unit and integration testing, and modern build, continuous integration, and release workflows.
- Practical experience selecting, integrating, configuring, or improving static analysis tools and resolving the issues they identify.
- Ability to work effectively in a complex codebase and drive improvements to software quality, reliability, and security.
The following skills and attributes are a plus:
- Experience applying secure software development lifecycle practices, including threat modelling, secure design, vulnerability management, and release governance.
- Experience with vulnerability disclosure, severity assessment, remediation planning, and security updates.
- Experience leading technical initiatives and influencing teams without direct line-management authority.
- Excellent written and verbal communication skills, with a collaborative and pragmatic approach.