Software Development Engineer, InfoSec

Description

Groupon is an experiences marketplace that brings people more ways to get the most out of their city or wherever they may be. By enabling real-time mobile commerce across local businesses, live events and travel destinations, Groupon helps people find and discover experiences––big and small, new and familiar––that make for a full, fun and rewarding life. Groupon helps local businesses grow and strengthen customer relationships––resulting in strong, vibrant communities. Even with thousands of employees spread across multiple continents, we still maintain a culture that inspires innovation, rewards risk-taking and celebrates success.

Groupon’s Information Security team is seeking a sharp Software Development Engineer with 5+ years of experience designing and implementing security-driven solutions within cloud-based development pipelines. Responsibilities will focus around the enhancement of Groupon’s SDLC and cloud-based security infrastructure including managing certificates and hardening authentication and authorization workflows. This candidate will also liaison with other infrastructure, and development teams within Groupon to ensure the safety of Groupon’s applications, customer and merchant data, and to protect systems from unauthorized access and abuse.

The ideal candidate will be responsible for the design, configuration, deployment, and management of security-focused solutions across a diverse team of infrastructure teams, software engineers, and system architects. You will work with these teams to determine and implement application security mechanisms for existing and new projects, either as software-based services, or cloud configuration being managed as code via technologies such as Terraform and/or CloudFormation. Additional projects include working alongside cloud routing teams to establish secure mutual TLS using service mesh technologies like Envoy to in a multi-cloud environment.

This role will encompass an environment consisting of some physical and virtual hosts, but mostly containerized applications running directly on cloud-based resources or within container orchestration environments such as Kubernetes. The ideal candidate will leverage prior experience working with cloud native services such as EC2, EKS, RDS, ACM, RAM, MSK, Lambda, and IAM, and will be able to articulate secure application design concepts.

Groupon is a “best of both worlds” kind of company big enough to have resources and scale, but small enough that a single person has a surprising amount of autonomy and can make a meaningful impact. We’re curious, fun, a little intense, and kind of obsessed with helping local businesses thrive. Does that sound like a compelling place to work?

Our development ecosystem:

• Languages: Java, Ruby on Rails, Node/Express JS
• MySQL/PostgreSQL
• REST/JSON APIs
• Deployment to AWS as code via Terraform
• Deployment to Kubernetes/EKS via Helm
• Jenkins
• GitHub
• JIRA

You’ll spend time on the following:

• Actively develop and maintain tooling to bring visibility to risks within our applications and infrastructure
• Implement new security technologies as required to support a dynamic/challenging business environment
• Challenge and Improve existing processes through data-backed decisions and automation to increase the security maturity
• Managing a set of security controls defined as infrastructure as code or policy-as-code
• Act as the champion for application security and secure coding practices within Groupon
• Work as a peer to technical leaders in engineering disciplines such as platform architecture, software development, network, and system administration.
• Manage change control policy and procedures.
• Provide technical and limited operational security support to IT, Engineering, Legal, and business units
• Maintain knowledge of the latest active security threats
• Help identify known vulnerabilities within software projects and help promote the best possible deliverables to production
• Effectively work across a geographically distributed team environment
• Maintain a high degree of self-sufficiency, ownership, and pride of deliverables
• Assist in the maintenance/development of security policies and procedures.

We’re excited about you if you have:

• BS or MS in Computer Sciences or related fields with 5+ years in software development and/or DevOps, ideally using Java, Python, Ruby, Node.js, and C#.
• 2+ years of experience securing applications in AWS or equivalent
• Proficiency with cloud automation-enabling tools such as CloudFormation and/or Terraform
• Hands-on experience designing usage and implementation of AWS native technologies such as Security Groups, IAM, S3, Secrets Manager, CloudTrail monitoring, etc.
• Hands-on experience with containerized applications running in a Kubernetes environment
• Functional ability as a Linux sysadmin with scripting experience
• Strong knowledge of networking and web related protocols (e.g., TCP, UDP, IPSEC, HTTP, HTTPS, network routing protocols)
• Experience working with many network security controls (Routers, Firewalls, Proxies, ACL’s, Wireless networking protocols), in particular their cloud-native equivalents
• Professional security certifications are nice-to-have but not required.
• Knowledge of PCI, SOX 404, Safe Harbor, and other regulations/standards.

We value engineers who are:

• Customer-focused: We believe that doing what’s right for the customer is ultimately what will drive our business forward.
• Obsessed with quality: Your production code just works & scales linearly
• Team players. You believe that more can be achieved together. You listen to feedback and also provide supportive feedback to help others grow/improve.
• Fast learners: We are willing to disrupt our existing business to trial new products and solutions. You love learning how to use new technologies and then rapidly apply them to new problems.
• Pragmatic: We do things quickly to learn what our customers desire. You know when it’s appropriate to take shortcuts that don’t sacrifice quality or maintainability.
• Owners: Engineers at Groupon know how to positively impact the business.

Groupon’s purpose is to build strong communities through thriving small businesses. To learn more about the world’s largest local ecommerce marketplace, click here for the latest Groupon news. Plus, be sure to check out the values that shape our culture, guide our strategy and make our company a great place to work. And just don’t take our word for it. Hear from real Groupon team members and learn more about our inclusive employee groups. If all of this sounds like something that’s a great fit for you, then click apply and let’s see where this takes us.

Groupon is an Equal Opportunity Employer

Qualifications for employment, promotion, and other terms and conditions of employment are based upon the ability to perform the job. Equal-employment opportunities are provided to all applicants and employees without regard to race, creed, religion, color, age, national origin, sex, disability, medical condition, sexual orientation, gender identity or expression, genetic information, ancestry, marital status, military discharge status (excluding dishonorable discharge), veteran status, citizenship status, or other legally protected status. We are all responsible for maintaining this policy. Groupon is committed to providing reasonable accommodations for qualified individuals with disabilities and disabled veterans in our job application procedures. If you need assistance or an accommodation due to a disability, you may email us at hraccommodations at groupon.com. If you have concerns related to Groupon’s equal employment opportunities, you may contact Groupon’s Ethics Reporting Service Ethicspoint.

Job ID : R24763