Application Security Officer

Job Description

The Company:

Hexagon is a global leader in digital reality solutions, combining sensor, software, and autonomous technologies. We are putting data to work to boost efficiency, productivity, quality, and safety across industrial, manufacturing, infrastructure, public sector, and mobility applications.

Our technologies are shaping the production and people-related ecosystems to become increasingly connected and autonomous - ensuring a scalable, sustainable future.

Hexagon's Mining division solves surface and underground mine challenges with proven technologies for planning, operations, and safety.

Hexagon (Nasdaq Stockholm: HEXA B) has approximately 24,000 employees in 50 countries and net sales of approximately 5.5bn USD. Learn more at hexagon.com and follow us @HexagonAB.
Purpose of Position:

The Application Security Officer will play a key role in conducting cybersecurity analysis and planning to ensure that our mining products are in compliance with industry standard cybersecurity practices and controls. You will work closely with our IT, DevOps, and Development teams to ensure that Secure Development Lifecycle processes are implemented and followed. You will take a systems level approach to threat and risk assessment and help define and implement controls to mitigate those risks. You will help define training and process for development teams to emphasize application security and security by design. You will continue to stay up to date with the latest in cybersecurity threats, vulnerabilities, and best practices to ensure the organizations security measures are always up to date.
Major Areas of Responsibility:

• Conduct product Cybersecurity audits and assessments and support third party audits and assessments.
• Develop Cybersecurity plans for Product Development and DevOps teams.
• Work with Product Management to address Cybersecurity and Process requirements.
• Work with Product Development to implement Secure Development Lifecycle practices and to address Cybersecurity and Process implementation.
• Work with DevOps team to identify and implement DevSecOps practices.
• Review and approve design and development output from a Cybersecurity perspective.
• Work with Information Technology team and Corporate Information Security officer to follow corporate security requirements and implement Cybersecurity best practices.
• Assist IT team and Organization in achieving security certification such as ISO 27001 or other similar industry standards.

• Bachelor's degree in Engineering (Systems, Electrical or Computer) or Computer Science or equivalent experience.
• The perfect candidate would have 2 plus years working in an environment under ISO 62443 or ISO 21434.
• Experience working in a security compliant product development environment with involvement in cybersecurity activities
• Ability to work productively with colleagues and cross functional teams
• Proficient in leading technical activities
• Strong analytical and problem solving skills
• Excellent verbal and written communication skills as it pertains to articulating, documenting and presenting findings and recommendations

• The perfect candidate would have some experience working under ISO 27034.
• Training certification in ISO 21434 is nice to have.
• Experience with industry standard Secure Software Development Lifecycle practices such as ASPICE, NIST and OWASP is nice to have.
• Industry certifications such as GSLC, CISSP, CEH a plus.

• Occasional Travel

• Fluent English (written and verbal) is a prerequisite.
• Salary commensurate with experience and work location.