Threat Modeling Professional | Remote

Summary

Threat Modeling Professional

This position may be offered to a candidate authorized to work in the US for his/her/their stated employer, without any restrictions which would prevent the candidate from working on the proposed assignment for the duration of the assignment period.

Must Haves:

• 2+ years of experience with Threat Modeling for applications, software Developing experience

Threat Modeling Professional to join our Information Security Architecture team. The Threat Modeling Professional will partner closely and collaboratively with Senior Threat Model personnel, Enterprise Architecture (EA), Developers, Platform Owners, and other areas of the firm to help ensure Freddie Mac provides secure services and solutions.

Duties and Responsibilities:

• Support the Security Architecture team to develop and mature a Threat Modeling Program by defining processes, procedures, controls, KRI's/KPI's, etc., that identify threats early in the development process reducing risks prior to deployment.
• Develop training material for how to engage the Threat Management service, make use of technologies, and interpret findings.
• Drive beneficial security change into the business through supporting Developers with creation of threat models for their applications and remediation of potential threats, balancing risk against business need.
• Remain aware of change to relevant frameworks such as MITRE, STRIDE, etc. and refresh the service accordingly.
• Work with the InfoSec functional teams in the development of the Information Security strategy and roadmap, including and with focus on Threat Modeling.
• Assess Security Risk from an Architectural Perspective and Apply a Risk-Based Approach to Security.

Qualifications:

• 5+ years of Information Technology experience, preferably within the financial services industry
• Minimum of 3 years' experience working as an Information Security Professional, preferably within the architecture or engineering disciplines
• Minimum of 1 years' experience working as an Information Security Threat Modeling subject matter expert at a senior level
• Experience or equivalent knowledge in architecting secure solutions across major domains including:
  • Cloud
  • Network
  • Data
  • Application
  • End-Point (User and Server)
  • Mobile Device
• Understanding of industry standard frameworks such as ISO 27001/27002, NIST, CIS, MITRE ATT&CK
• Strong problem solving and verbal and written communication skills
• Passion for leading change and ability to bring others along
• (Desirable) CISSP (+ ISSAP), CCSP
• (Desirable) One or more security-related certifications associated with AWS, GCP or Azure

Keys to Success in this Role:

• Strong verbal and written communication skills.
• Ability to work with others.
• Self-motivated with attention to detail.
• Excellent presentation, program management and relationship management skills.

Job Description

Threat Modeling Professional

This position may be offered to a candidate authorized to work in the US for his/her/their stated employer, without any restrictions which would prevent the candidate from working on the proposed assignment for the duration of the assignment period.

Must Haves:

• 2+ years of experience with Threat Modeling for applications, software Developing experience

Threat Modeling Professional to join our Information Security Architecture team. The Threat Modeling Professional will partner closely and collaboratively with Senior Threat Model personnel, Enterprise Architecture (EA), Developers, Platform Owners, and other areas of the firm to help ensure Freddie Mac provides secure services and solutions.

Duties and Responsibilities:

• Support the Security Architecture team to develop and mature a Threat Modeling Program by defining processes, procedures, controls, KRI's/KPI's, etc., that identify threats early in the development process reducing risks prior to deployment.
• Develop training material for how to engage the Threat Management service, make use of technologies, and interpret findings.
• Drive beneficial security change into the business through supporting Developers with creation of threat models for their applications and remediation of potential threats, balancing risk against business need.
• Remain aware of change to relevant frameworks such as MITRE, STRIDE, etc. and refresh the service accordingly.
• Work with the InfoSec functional teams in the development of the Information Security strategy and roadmap, including and with focus on Threat Modeling.
• Assess Security Risk from an Architectural Perspective and Apply a Risk-Based Approach to Security.

Qualifications:

• 5+ years of Information Technology experience, preferably within the financial services industry
• Minimum of 3 years' experience working as an Information Security Professional, preferably within the architecture or engineering disciplines
• Minimum of 1 years' experience working as an Information Security Threat Modeling subject matter expert at a senior level
• Experience or equivalent knowledge in architecting secure solutions across major domains including:
  • Cloud
  • Network
  • Data
  • Application
  • End-Point (User and Server)
  • Mobile Device
• Understanding of industry standard frameworks such as ISO 27001/27002, NIST, CIS, MITRE ATT&CK
• Strong problem solving and verbal and written communication skills
• Passion for leading change and ability to bring others along
• (Desirable) CISSP (+ ISSAP), CCSP
• (Desirable) One or more security-related certifications associated with AWS, GCP or Azure

Keys to Success in this Role:

• Strong verbal and written communication skills.
• Ability to work with others.
• Self-motivated with attention to detail.
• Excellent presentation, program management and relationship management skills.