Security Specialist(Product Security), CISO Office, Tokyo

• Additionally, the CISO Office is responsible for strengthening the security of our internal information systems.
• About the CISO Office Our mission is to "Maximize the value delivered to our customers through security." We define and create the ideal security state for the entire Money Forward Group.

About 株式会社マネーフォワード

At Money Forward, we develop a wide range of popular services, including our automated personal financial management tool "Money Forward ME" and the "Money Forward Cloud" suite for businesses.

Our ecosystem is powered by advanced technologies such as "Account Aggregation" and our single sign-on system, "Money Forward ID." As our services handle sensitive financial data, we maintain the highest standards of security.

The CISO Office works closely with our business units to ensure and enhance the security of our products.

To provide a safe and secure experience for even more users, we are looking for a Security Specialist to join our team.

Preventing service downtime and information leakage is, of course, critical.

However, that is only one part of what we value.

Excessive security measures can slow down development, potentially reducing or delaying the value we provide to our customers.

As security professionals, we constantly ask ourselves how we can maximize customer value and implement the most optimized security solutions to achieve that goal.

Principles We consider the ideal state of security and our organization through three core themes: Embedded security in business strategy Security does not exist in a vacuum.

Advanced balancing between security and experience The highest level of security is not always the "right" answer.

We must assess risks and always consider the most suitable security measures.

Instead of simply avoiding risk, we sometimes choose to take calculated risks to pursue maximum user value.

To achieve a sophisticated balance between convenience and security, we actively promote automation and autonomous systems.

Autonomous and scalable organization of security As the Money Forward Group grows into a larger development organization, we aim to deliver even greater value.

If the CISO Office handles every single security function, we will become a bottleneck and fail to scale.

As we enter a phase of evolving into Japan's No.

We have a library system where you can freely borrow books, ranging from technical books to management books.

Responsibilities

• This includes the governance and visualization of major cloud platforms like AWS and GCP, as well as the design, implementation, and operation of common security features such as WAF.
• We design security measures in alignment with business strategies, taking into account the current business phase, costs, projected revenue, and potential loss in the event of a risk.
• Over-securing can increase costs and compromise user convenience.
• Each development department must be able to build secure services autonomously.
• The CISO Office focuses on building the frameworks and providing the support necessary to enable this autonomy.
• In this position, you will leverage your knowledge and experience in coding and infrastructure to maintain and enhance the security of Money Forward in collaboration with developers and IT infrastructure teams.
• As a Product Security Specialist, you will drive the following initiatives alongside other security specialists in the CISO Office: Establishment of security guardrails for AWS, Azure, and GCP environments.
• Providing technical advice on security and conducting architecture reviews for our developers.
• Performing or supporting security evaluations.
• Developing tools and scripts to automate or enhance security.
• Integrating security into modern development workflows, including K8s, Docker, and CI/CD pipelines.

Requirements

• Implementing and deploying security frameworks such as NIST CSF and CIS Controls.
• Foundational understanding of computer science, including networking, operating systems, data structures, and cryptography.
• Experience in software development with at least one programming language, or hands-on experience practicing Security by Design.
• Business-level English communication skills.
• Knowledge or experience in any of the following areas: Vulnerability assessment Penetration testing or Red Teaming operations Forensics, malware analysis, or incident response Cloud security Architecture reviews Building and operating DevSecOps workflows Implementation and operation of security solutions (e.g., WAF, IDS/IPS, SIEM) Preferred Skills and Experience Business-level Japanese communication skills.
• Experience participating in CTFs (Capture The Flag).
• Experience in bug hunting or obtaining CVEs (Common Vulnerabilities and Exposures).
• Relevant certifications such as CISSP, CISM, OSCP, GCIH, etc.
• Deep understanding of Authentication and Authorization (e.g., OIDC, OAuth).
• Experience in security-related operations within the Financial or Fintech industry (e.g., knowledge of FISC guidelines).
• Experience in AI development and/or experience in using AI tools to improve development processes.
• Money Forward is at a major turning point, shifting "from Cloud to AI." We are currently driving "AX (AI Transformation)"—the next step beyond DX—with the goal of providing "Digital Workers," where AI agents autonomously execute tasks.
• 1 back-office AI company by integrating AI agents into all of our products in the future, we are looking for individuals who can contribute to AI-driven development and value creation.(More information here) Language Requirements English: Business level Work Environment At Money Forward, we provide an environment where we can create world-class services together, and we are looking forward to welcoming you.

Preferred

• Collecting and verifying vulnerability information, including OSINT (Open Source Intelligence).

Benefits

• We provide PCs equipped with the latest CPUs (MacOS or Windows).
• Custom-made PCs tailored to business requirements and replacements with the latest OS are also possible.
• Peripheral devices necessary for work (such as displays, mice, keyboards) can be purchased as office supplies.
• Generally, you can choose from standard products (catalog), and if conditions are met, you can apply for non-standard products as well.
• Desired books can be purchased at the company's expense.
• We cover the cost of recruitment meals.
• There is a referral reward system.

Conference Participation Support

The company partially covers participation in domestic and international conferences, such as RubyKaigi and Google I/O.