What We Do:
The Software Engineering Institute helps advance software engineering principles and practices and serves as a national resource in software engineering, computer security, and process improvement. The SEI works closely with defense and government organizations, industry, and academia to continually improve software-intensive systems. Our core purpose is to help organizations improve software engineering capabilities and develop or acquire the right software, defect free, within budget and on time, every time.
The Secure Coding Team of the world renowned CERT division of the SEI is a pioneer of the identification and development of secure coding and secure software development practices. We are looking for an exceptional person to help us continue our leadership of ground-breaking improvements for securing software during development. Software has never been more important to our lives and our national security, nor has software insecurity ever been a greater risk.
If you join the team, you will work with cyber security experts to help software developers and software development organizations reduce vulnerabilities resulting from coding errors before they are deployed. You will improve software security by identifying common programming errors that lead to software vulnerabilities, establishing secure coding standards, developing evaluation tools, and educating software developers.
Software vulnerabilities constitute a major threat to many of our nation’s critical systems. You will help our team develop techniques for improving the security of source code. You will participate in research and engineering projects, write reports, and deliver presentations that explain your work, and work with customers to help transition our work into practice.
We are looking for someone familiar with program analysis or compiler development (particularly dataflow analysis or other forms of static analysis). You will contribute to our project to automatically repair C source code to remove memory-safety vulnerabilities. The ultimate goal is to enable a proof of some or all aspects of memory safety of the repaired program. By repairing at the level of source code (as opposed to a compiler pass, like AddressSanitizer or SoftBound+CETS), the user isn’t tied to a particular build chain and will be able to manually tune critical sections of the codebase.
- You have a BS in Computer Science or Software Engineering with at least three (3) years applicable experience
- You are willing to travel to other SEI locations, sponsor sites, conferences and offsite meetings (10% or less).
- You will be subject to a background investigation and must be eligible to obtain and maintain a Department of Defense security clearance
Knowledge, Skills and Abilities:
You will have the knowledge, skills, and abilities to:
- Meet inflexible deadlines and deal with challenges while maintaining professionalism
- Develop new static-analysis tools. Familiarity with compilers at least to the level of an undergrad compilers course, especially dataflow analysis and implementing compiler optimizations. Firm grasp of data structures and algorithms
- Develop and analyze source code in the C and Python programming languages as well as other common programming languages such as C++, C#, and Java, with a focus on secure coding principles and practices
- Use static and dynamic analysis tools to evaluate software to find and remove vulnerabilities
- Build and configure various software build environments, and build custom tools to integrate and automate the use of software building and analysis tools
- Analyze data from multiple sources, generate defensible results, and represent them in reporting products and interactions with customers, sponsors, and the public
- Collaborate in a team environment with other team members with varying skills, experience and locations
- Recognize and deal appropriately with confidential and sensitive information such as source code and software weaknesses and vulnerabilities
- Develop and explain technical decisions and recommendations effectively with technical and non-technical audiences through verbal and written communications leading to actionable and measurable improvements
- Work meticulously with careful attention to detail required to identify defects and weaknesses in large software systems, and to identify development process improvement opportunities
- Be self-motivated and capable of self-learning to maintain a working knowledge of the ever-changing software development landscape
- Contribute to program objectives and plan development
- Perform under minimal direction and use independent judgement when necessary
- MS in Computer Science or Software Engineering, with at least one (1) year applicable experience
- Thorough knowledge of the C programming language. Experience developing with the C++ programming language. Basic familiarity with x86 assembly language. Ability to read and write code in Python. Ability to write an analysis pass for LLVM. Ability to develop and evaluate software that exhibits desired security properties.
- Develop and analyze software for specific platforms, such as mobile platforms and embedded systems
Job Function Breakdown:
40% Contribute to internally funded research projects, developing experimentation environments, evaluating secure software development practices, and communicating results internally and externally in reports and presentations.
30% Directly support customer work in secure coding, verification and validation techniques, and technical training. Tailor our current offerings to provide value to customers by evaluating their software, software development, and software acquisition/procurement practices, and providing improvement recommendations. Communicate the findings of such evaluations through reports and presentations. Build new tools and capabilities that improve our ability to meet customer needs.
15% Codify knowledge that has been gained through customer and research projects to expand and update knowledge transfer materials, such as Secure Coding guidelines, training materials, and tools.
15% Develop knowledge and understanding of SEI capabilities; learn how SEI capabilities can be applied to customer problems; work directly with SEI staff supporting the community with disciplines related to secure coding and secure development.
Please visit “Why Carnegie Mellon” to learn more about becoming part of an institution inspiring innovations that change the world.
A listing of employee benefits is available at: www.cmu.edu/jobs/benefits-at-a-glance/.
Carnegie Mellon University is an Equal Opportunity Employer/Disability/Veteran.