Experienced Security Tools Engineer - Static Code Analysis, Lund

Are you ready to be part of a Platform Engineering team that provides 900 developers with an Internal Developer Platform (IDP) that helps secure AXIS OS, the embedded Linux distribution that powers our products? This is an area where Axis is actively expanding, with continued investment that reflects its strategic importance to our product portfolio.

As part of our security tooling sub-team, you will play a key role in static code analysis, today centered on Coverity, and help AXIS OS developers use it to find and fix vulnerabilities before they ship. The long-term ambition is to grow this into a broader static code analysis ecosystem over time. If you are passionate about application security and static analysis and are looking for the possibility to work with like-minded professionals, then this can be the perfect opportunity for you!

Your future team You will be part of a growing Platform Engineering team, divided into small, highly collaborative, and autonomous sub-teams. You will join our security tooling sub-team, responsible for the security-related tooling including vulnerability scanning and management, supply chain evaluation, and static code analysis. The IDP is built with a mix of open-source software, internally developed tools, and vendor licensed software. We're active in several open-source communities and you're encouraged to contribute to and engage with them.

You and your teammates own the sub-team backlog, and you are responsible for the evolution of your area of responsibility. You are encouraged to explore new ideas and technologies, and your teammates will be available for feedback and support. We are great at what we do, and we are sure you will be inspired by our drive to always improve and learn more. The tools you will work on are used by AXIS OS developers every day and you will be challenged and learn much from working close with them to improve how the work, day to day.

Our culture is characterized by openness, trust, and collaboration. Work/life balance and hanging out with your teammates at common fikas, lunches, and other social activities are important to us and our success. Like the rest of Axis, we don't let ourselves get stuck in rigid processes. Rather, we rely on the Axis Act As One spirit and work closely to achieve our shared goals.

What will you do as a security tools engineer? You will join our security tooling sub-team. Your initial focus will be on strengthening our work with Coverity, our static code analysis service, while also taking part in the sub-team's broader work. You will work in close collaboration with AXIS OS developers to understand their needs and pain points and how static analysis can support them in their daily work, as well as support the use of Coverity for compliance purposes.

This will give you an idea of what you'll be working on:

• Configure and refine Coverity's static analysis capabilities to keep them effective for AXIS OS developers
• Support AXIS OS developers in how to use static code analysis effectively to find and resolve vulnerabilities and quality issues
• Work closely with AXIS OS product management to ensure that the Coverity setup supports compliance needs
• Work in close cooperation with AXIS OS developers to understand their needs and how we can help them by improving our tools and services
• Evaluate and introduce new features and capabilities related to static code analysis
• Collaborate with the rest of the security tooling team on vulnerability scanning, supply chain evaluation, and other security tooling initiatives
• Align with other area experts across the larger Platform Engineering team to share knowledge and make sure our tools and services fit into the bigger picture

Who are we looking for/Who are you? We are looking for an open, creative, and pragmatic problem solver that likes to combine long-term thinking and structure with the here and now that naturally follows from working closely with users. You are motivated by new challenges and are eager to learn, but you also get energy from helping others grow by sharing your knowledge. Like us, you value teamwork and want to contribute to our great team spirit. You have a security mindset and enjoy digging into how tools and processes can help developers write more secure, higher quality code.

We would love to hear that you have:

• University degree in Computer Science or a comparable qualification
• Professional experience with software development, with a genuine interest in application security and code quality
• Solid understanding of software development process and life cycle with focus on Continuous Integration (CI)
• Hands-on experience with static code analysis tools, e.g. Coverity, SonarQube, or similar
• Knowledge of C and C++ development, secure coding practices, and standards such as CERT C/C++ or MISRA C
• Experience with vulnerability management, supply chain security, or compliance work, e.g. the EU Cyber Resilience Act (CRA) or ISO 27001
• An understanding of embedded development
• Experience with git and code review tools, e.g. Gerrit

What Axis has to offer! At Axis you will be able to grow as a developer and use your creativity to experiment and from time to time make mistakes that can be a valuable source of new knowledge. Working with tools that directly affect the security and quality of AXIS OS, you will get immediate feedback from the developers who rely on them. You will work closely with experienced experts, developers and testers that love to overcome technical challenges together. Our culture is characterized by openness, trust, and collaboration. Finally, check out Engineering at Axis to get an insight into who we are.

Ready to Act? Find out more from our recruiting manager Håkan Rick at 0733 35 90 23. We're looking forward to reading your application!