Engineering Manager Application Security

As a manager on the Privacy team, you will be responsible for programs that implement the three A’s: Authentication, Authorization, and Accounting.  This domain will include managing the privacy of user accounts on an enterprise scale,  implementing all elements of GDPR and related programs, managing secrets, and managing service calls in a security-conscious environment.  The projects will include new development work on data locality, PII vaults, and zero-trust architectures. The work includes people management of a development team of full-stack web developers.

 

Our teams have a high degree of autonomy to define their mission, vision, strategy and select and prioritise the projects to work on in order to deliver the business results to our customers. 

 

At Udemy, we strongly believe that diversity, open-mindedness, and good communication yield the best results. Our team members come from various backgrounds. We work collaboratively and cross-functionally, taking ownership of doing the right things and getting them done. We are looking for someone to join the team who has demonstrable experience in some of the areas listed below and a desire to learn and master anything else that comes their way – we are a learning company after all!

 

Key Responsibilities:

• Build and manage teams dedicated to Privacy and related security concerns.  This would include hiring new team members, and potentially overseeing external contractors brought in for shorter-term projects.
• Design and implement new projects for PII vaults, integration with subprocessor APIs, and user-friendly reporting.  The work will primarily involve back-end coding, but there are front-end elements to most projects.
• Work with peers inside Udemy to determine priorities for privacy concerns.
• Review technical designs and code-review the work of other groups to ensure that privacy, authorization, and application security concerns are adequately managed for proposed and in-flight projects. 
• Plan, organize, and complete work within agile sprints using common DevOps guidelines, with a heavy focus on testing, CI/CD, and automated monitoring.
• Grow and nourish a team culture that values openness, inclusiveness, respect, quality, robustness, scalability, and humility while fostering innovation.
• Share related knowledge with the members of the wider engineering team through training and internal blogging.

Core Competencies:

• Minimum four years of experience managing web development teams, or working as a team lead.
• Minimum four years of experience with web application technologies including HTTP, HTML, CSS, and JavaScript
• Minimum two years of experience with object-oriented languages (Java or Kotlin), ideally scripting languages like Python, Ruby, or PHP.
• Experience with operating in public cloud environments (e.g., AWS, GCP, Azure).
• Strong technical communication skills
• Knowledge of object-oriented software design patterns and computer science fundamentals (e.g. data structures, algorithms) 
• Testing methods, including unit and end-to-end tests

Nice to Haves:

• Familiarity with practices around GDPR, CCPA, PIPL
• Knowledge of website security, such as headers, cookies, CORS, XSS, etc.
• Understanding of authentication technologies such as OAuth, SAML, OIDC, JWT
• Experience with modern Javascript frameworks (e.g., React, Angular, Vue, NodeJS, NextJS, etc.).
• Experience with microservices, Istio or other service mesh architectures.
• Experience with Kubernetes, Docker or other containerization technologies.
• Understanding of any security-related compliance practices such as SOX, SOC-2, PCI, ISO 27001, HITECH, HITRUST.
• Understanding of top OWASP vulnerabilities or frameworks like MITRE ATT&CK.