MarshMcLennan Canada is seeking candidates for the following position based in our Toronto or New York offices.

SSDLC / DevSecOps Engineer

What can you expect?

Lead initiatives related to DevSecOps and SSDLC.
Define and enhance the company’s Secure Software development Lifecycle (SSDLC) which in turn will reflect the company’s Application Development Security Policy,
Select and standardize application security tools. This includes vendor/tool assessments and full POC,
Integrate SSDLC requirements and other security policy/requirements into the DevOps processes,
Define and enhance application security requirements and standards which must be designed for agile development methods leveraging traditional application architectures as well as cloud architectures and container workloads.

What is in it for you? (This section is from the company and no additions are required)

MarshMcLennan Canada offers competitive employee benefits and a thriving culture
A company with a strong Brand and strong results to match;
Employee Resource Groups which provide access to leaders, relevant volunteer and mentoring opportunities, and interactions with counterparts in industry groups and client organizations.
Competitive pay (salary and bonus potential), Full benefits package – starting day one (medical, dental, vision, STD/LTD, life insurance, RSP (Retirement Savings Plan or TFSA (tax free savings account).
Tuition Reimbursement plan and participation in our Employee Stock Purchase Plan.
Entitled to vacation, floating holidays, time off to give back to your community, sick days, and provincial/national holidays (with early dismissal).

We will count on you to:

Advise the application security leadership on best practices and standards around application security tools with main focus to unify vulnerability reporting, create predictable CI/CD pipeline processes, and enable application teams to develop new capabilities securely, and free from security defects, by design
Assess security tools currently used within the various business Software Development Life Cycle processes to identify business requirements, and rationalize the tools set
Select new application security tools including vendor/tool assessments and conduct full POC to prove that the security solutions/products are fit-for-purpose and fit-for-use
Draft documentations for the SSDLC and DevSecOps to illustrate the frameworks and process guidelines to internal customers ensuring the style is palatable and easy to navigate
Assess impact of new publications from the security industry (e.g. NIST 800-XXX, ISO 2700X:2022, etc) on the company’s AppSec programs
Research new trends and advise the application security leaderships on impact of the new trends as they relate to currently used tools, tool chain roadmap, efficiency and effectiveness of current processes, etc.
Standardize code weakness analysis processes
Promote the priorities set forth by Global Information Security function, and the roadmap set forth by the Global Application Security

What you need to have:

5 years+ DevSecOps and SSDLC work experience
CISSP, CSSLP, cloud security, DevSecOps automation, or similar is required
Post-secondary education or equivalent experience as a DevSecOps Engineer
Develop/enhance and implement the SSDLC framework
Design, implement, and rollout DevSecOps automations and tool chain
Implement sensors to collect data on key metrics for statistics and reporting
Serve as the subject matter expert in SSDLC and DevSecOps
Advise on the processes and standards that are designed to implement a company’s Application Development Security Policy
Experience in designing SSDLC processes and relevant tooling to support the processes
Experience in software/application analysis tools like SAST, DAST, SCA, IAST, RASP, threat modeling, etc.

What makes you stand Out:

Identify application security requirements and brainstorm solutions
Assess the tooling and remediation of threats and vulnerabilities within our software/applications, and the hosting environment

In accordance with applicable legislation, MarshMcLennan will provide a reasonable accommodation to employees and prospective employees to the point of undue hardship upon request and as required in respect of the individual’s particular restrictions and limitations. If you require a specific accommodation because of a disability or medical need please contact TANA@mmc.com.

MarshMcLennan is the world’s leading insurance broker and risk adviser. With over 35,000 colleagues operating in more than 130 countries, MarshMcLennan serves commercial and individual clients with data driven risk solutions and advisory services. MarshMcLennan (NYSE: MMC) is the leading global professional services firm in the areas of risk, strategy and people. With annual revenue approaching US $17 billion and 76,000 colleagues worldwide, MMC helps clients navigate an increasingly dynamic and complex environment through four market-leading businesses: MarshMcLennan, Guy Carpenter, Mercer, and Oliver Wyman. Follow MarshMcLennan on Twitter @MarshMcLennanGlobal; LinkedIn; Facebook; and YouTube, or subscribe to BRINK.

MarshMcLennan is committed to embracing a diverse, inclusive and flexible work environment. We aim to attract and retain the best people regardless of their sex/gender, marital or parental status, ethnic origin, nationality, age, background, disability, sexual orientation, gender identity or any other characteristic protected by applicable law.

MMC Corporate

New Jobs

SSDLC/DevSecOps Engineer