Sr Technology Risk Analyst (2 openings)

Having a strong financial future has a lot to do with the choices you make today.
One smart move is choosing to invest with Fidelity. We offer the guidance, competitive pricing, and investment options you need to reach your goals.




The SDLC program mitigates application-level security vulnerabilities and defects as part of the development process. The program’s objective is to empower Fidelity’s development community to build secure applications with state-of-the-art application vulnerability discovery tools, training, and defined processes and methodologies. Security verification is moved into the business unit, allowing early detection of vulnerabilities, and eliminating as many security vulnerabilities as possible, early, and within the application’s development lifecycle.

 

The tools supporting the secure development initiative are Fortify, and AppScan.  Fortify is a source code analyses tool used by developers to scan their source code, as part of the development process, for security vulnerabilities. AppScan is a tool used by QA to test running applications for security vulnerabilities as part of the QA process.

 

This position is responsible for supporting both Fortify and AppScan.  This involves working with both the tool vendors as well as supporting the customers using the tools. 

 

Responsibilities:

Fortify:Work with BUs, ISOs, PMs, Architects, and developers to adopt Fortify as part of the development processPresentations and demonstrations of Fortify to the development communityConsultant for user to chose the correct technology to meet there needsConsultant for trouble shooting and problem solving


Fortify User support:Answer questionsWrite support documents, KB, articles, FAQ ... Deal with Vendor/Contractors (Fortify, Cigital...) for bug reports, new feature requirements, technical questions, new release roadmaps, ... to make the product better and satisfy Fidelity’s needsResearch common security vulnerabilities for rule developmentAnalysis of scan results


 

AppScan:Act as the SME for AppScan and its use as the security test tool within the BUs’ QA process. Work with BUs to help incorporate AppScan as part of their QA process Work with QA to resolve issues in running AppScan against the QA application Work with vendor to help resolve issues AppScan presentations and demonstrations to BUs Maintain and update user documentation Maintain and update templates used by AppScan Work with other BUs in integrating AppScan and WebXM into their QA environments and products such as TestDirector Maintain and update the infrastructure supporting AppScan (Web site, KB, FAQ, SharePoint)Plan and determine enhancements within AppScan as well as next generation products such as WebXM

 

 


 

4+ years of Java developmentJ2EE knowledge and development skills, WEB application, Servlet, JavaScript, HTML, JSP, ...Experiments in XML, XML Schema, XpathExperiments in using Eclipse, WSAD, or RADStrong written and verbal communication skillsFamiliarity with UNIX (Solaris, AIX, or Linux)Working knowledge of the HTTP protocol conceptsWorking knowledge of networking infrastructure conceptsFamiliarity with the web serversExperience in writing QA test plansWorking knowledge of basic database concepts