About TRS

Since 1917, the Teachers’ Retirement System of the City of New York (TRS) has been securing better futures for NYC educators. With a pension fund valued at approximately $120 billion, TRS serves over 215,000 members, providing them with retirement, disability, and death benefit services.

Position Summary

The Software Developer will be responsible for securing a custom enterprise application built with Low Code Application Platform (LCAP) tools such as Mendix. This role involves a range of tasks with varying levels of complexity and responsibility, including architecture analysis, software development, and data analysis. Key duties will also include triaging cyber event alerts, conducting investigations, and maintaining documentation; developing and reviewing cybersecurity policies; auditing systems; and managing risk. The position requires supporting efforts to identify and address potential security risks, ensuring adherence to security standards, and responding to vulnerabilities in the application code.

Key Responsibilities

- Develop cyber security related processes to mitigate and prevent any security risks.
- Monitor security alerts and vulnerabilities across Mendix applications and integrated systems.
- Perform initial triage of alerts to determine potential security risks and escalate as necessary.
- Support incident response activities, including documentation and root cause analysis.
- Conduct vulnerability scans on Mendix applications and environments using tools like Sigrid QSM.
- Identify and assess security weaknesses and help prioritize remediation efforts.
- Serve as a subject matter expert on characterizing and analyzing vulnerabilities of the enterprise application, identified using tools like Sigrid QSM.
- Assist in the development of security recommendations and best practices.
- Assist in ensuring applications adhere to compliance standards applicable to the organization.
- Support user access reviews and privilege management to prevent unauthorized access.
- Monitor and enforce secure application and data access policies.
- Provide support for internal cybersecurity training initiatives, helping educate developers on secure practices.
- Collaborate with development and production support teams to promote secure coding and testing practices within Mendix.
- Document security processes, findings, and incidents.
- Prepare reports on cybersecurity metrics, incidents, and security control effectiveness.

1. A baccalaureate degree, from an accredited college including or supplemented by twenty-four (24) semester credits in cyber security, network security, computer science, computer programming, computer engineering, information technology, information science, information systems management, network administration, or a pertinent scientific, technical or related area; or

2. A four-year high school diploma or its equivalent approved by a State’s department of education or a recognized accrediting organization and three years of satisfactory experience in any of the areas described in “1” above; or

3. Education and/or experience equivalent to “1” or “2”, above. College education may be substituted for up to two years of the required experience in “2” above on the basis that sixty (60) semester credits from an accredited college is equated to one year of experience. In addition, twenty-four (24) credits from an accredited college or graduate school in cyber security, network security, computer science, computer programming, computer engineering, information technology, information science, information systems management, network administration, or a pertinent scientific, technical or related area; or a certificate of at least 625 hours in computer programming from an accredited technical school (post high school), may be substituted for one year of experience.

- Bachelor’s degree in computer science or a similar degree. - Knowledge of cybersecurity principles, threat vectors, and defensive practices. - Understanding of web application security concepts. - Exposure to Cyber Security Static code analysis tools like Sigrid QSM. - Experience with low-code/no-code platforms, ideally Mendix is a plus. - Analytical skills and ability to interpret security alerts, vulnerabilities, and risk assessments. - Exposure to web application development and maintenance is a plus. - Experience working on a support or development team at enterprise level. - Google Cybersecurity or similar certifications are a plus. - Ability to work in a fast-paced environment and perform duties without direct supervision. - Possess the ability to work in a team environment and collaborate with others. - Excellent time management skills with the ability to prioritize and coordinate multiple tasks to ensure project deadlines are met.

This position is also open to qualified persons with a disability who are eligible for the 55-a Program. Please indicate at the top of your resume and cover letter that you would like to be considered for the position through the 55-a Program.

As a prospective employee of the City of New York, you may be eligible for federal loan forgiveness programs and state repayment assistance programs. For more information, please visit the U.S. Department of Education’s website at https://studentaid.gov/pslf/.

New York City residency is generally required within 90 days of appointment. However, City Employees in certain titles who have worked for the City for 2 continuous years may also be eligible to reside in Nassau, Suffolk, Putnam, Westchester, Rockland, or Orange County. To determine if the residency requirement applies to you, please discuss with the agency representative at the time of interview.

The City of New York is an inclusive equal opportunity employer committed to recruiting and retaining a diverse workforce and providing a work environment that is free from discrimination and harassment based upon any legally protected status or protected characteristic, including but not limited to an individual's sex, race, color, ethnicity, national origin, age, religion, disability, sexual orientation, veteran status, gender identity, or pregnancy.