Senior Product Security Engineer

Who We Are As the leader in cloud-managed IT Cisco connects passionate people to their mission by simplifying the digital workplace Our impact is driven by the innovative purposeful and vibrant people who make up our inclusive community When technology is intuitive our customers can focus on what matters About The team As a member of the Device Trust Assurance team you will have a substantial impact on the security of millions of Cisco devices all around the world We are looking for people who are passionate about security and eager to learn the ropes of vulnerability management reporting triaging and driving remediation About The Role The Vulnerability Management Engineer plays a critical role in ensuring the security of our systems by managing and mitigating vulnerabilities Key responsibilities include reviewing vulnerability scanning reports assessing severity and triaging vulnerabilities along with efficiently managing Jira tickets to facilitate timely remediation or mitigation This role requires utilizing tools such as Vigiles yocto CVE scanner to conduct vulnerability scanning and analysis and implementing a risk-based prioritization method for effective management Leading process optimization efforts by identifying gaps in the vulnerability management workflow and enhancing program efficiency is also essential Collaboration with international security organizations as well as engineering teams is necessary to provide guidance on mitigating and remediating vulnerabilities identify and report automation bugs and contribute to solutions that reduce manual workload in the vulnerability management lifecycle The role involves investigating vulnerability alerts assessing their impact and calculating severity scores based on attack complexity Additional duties include maintaining scanning tools reviewing CVEs for potential risk exceptions and guiding teams on security best practices and patch management standards Flexibility to work across different time zones is crucial for effective global collaboration and system security focusing on vulnerability management across Cisco s core platforms including but not limited to IOS-XE network operating systems SD-WAN infrastructure and controllers Meraki cloud-managed devices IIoT Industrial IoT solutions Qualifications 7 years in vulnerability management or network security with strong focus on Cisco technologies Experiences in Cisco IOS-XE architecture including kernel components and security mechanisms In-depth knowledge of common Security vulnerabilities OWASP Top 10 CWE Top 25 Proficiency with vulnerability scanning tools Semgrep coverity blackduck vigiles yocto cve scanner and firmware analysis Experience with SBOM Software Bill of Materials analysis Ability to trace through Linux kernel configuration systems KCONFIG and interpret Makefiles Strong C programming skills and understanding of conditional code compilation Experience with scripting languages Python Bash and network analysis tools Wireshark Proven ability to collaborate effectively across global teams and multiple time zones Consistent track record to ship in a dynamic environment Experience using Jira and other Atlassian software Bonus points Cisco security certifications CCNA CCNP Security and cybersecurity credentials CISSP CEH preferred Experience with industrial OT security standards IEC 62443 NIST Cybersecurity Framework Bachelor s degree in Computer Science IT or related field Cisco is an Affirmative Action and Equal Opportunity Employer and all qualified applicants will receive consideration for employment without regard to race color religion gender sexual orientation national origin genetic information age disability veteran status or any other legally protected basis Cisco will consider for employment on a case by case basis qualified applicants with arrest and conviction records Message to applicants applying to work in the U S and or Canada When available the salary range posted for this position reflects the projected hiring range for new hire full-time salaries in U S and or Canada locations not including equity or benefits For non-sales roles the hiring ranges reflect base salary only employees are also eligible to receive annual bonuses Hiring ranges for sales positions include base and incentive compensation target Individual pay is determined by the candidate s hiring location and additional factors including but not limited to skillset experience and relevant education certifications or training Applicants may not be eligible for the full salary range based on their U S or Canada hiring location The recruiter can share more details about compensation for the role in your location during the hiring process U S employees have to quality medical dental and vision insurance a 401 k plan with a Cisco matching contribution short and long-term disability coverage basic life insurance and numerous wellbeing offerings Employees receive up to twelve paid holidays per calendar year which includes one floating holiday for non-exempt employees plus a day off for their birthday Non-Exempt new hires accrue up to 16 days of vacation time off each year at a rate of 4 92 hours per pay period Exempt new hires participate in Cisco s flexible Vacation Time Off policy which does not place a defined limit on how much vacation time eligible employees may use but is subject to availability and some business limitations All new hires are eligible for Sick Time Off subject to Cisco s Sick Time Off Policy and will have eighty 80 hours of sick time off provided on their hire date and on January 1st of each year thereafter Up to 80 hours of unused sick time will be carried forward from one calendar year to the next such that the maximum number of sick time hours an employee may have available is 160 hours Employees in Illinois have a unique time off program designed specifically with local requirements in mind All employees also have access to paid time away to deal with critical or emergency issues We offer additional paid time to volunteer and give back to the community Employees on sales plans earn performance-based incentive pay on top of their base salary which is split between quota and non-quota components For quota-based incentive pay Cisco typically pays as follows 75 of incentive target for each 1 of revenue attainment up to 50 of quota 1 5 of incentive target for each 1 of attainment between 50 and 75 1 of incentive target for each 1 of attainment between 75 and 100 and once performance exceeds 100 attainment incentive rates are at or above 1 for each 1 of attainment with no cap on incentive compensation For non-quota-based sales performance elements such as strategic sales objectives Cisco may pay up to 125 of target Cisco sales plans do not have a minimum threshold of performance for sales incentive compensation to be paid