Application Security Engineer

Application Security Engineer

The Application Security Engineer will be responsible for analyzing software code repositories, code designs, processes, and implementation from a security perspective, and work with software development and infrastructure teams to identify and resolve security issues. You will include the appropriate security analysis, defenses and countermeasures at each phase of the software development lifecycle, to result in secure, robust and reliable software. An ideal candidate is someone that has experience in software development and information security, technical knowledge of the broad aspects of application and information security, and the soft skills to build a DevSecOps culture within an existing environment.

Advanced knowledge and understanding of AppSec tools: SourceClear, BlackDuck, Threadfix, SonarQube and Checkmarx

Experience with manual penetration testing as well as dynamic web application vulnerability scanning tools and services

A strong desire to learn new and upcoming technologies Preferred Experience Candidate should meet several of the following qualifications:

• 5-7 years experience developing software applications
• 3-5 years experience implementing tools in support of and using CI/CD pipelines; experience integrating security tools into the pipeline and developer workflow
• 3-5 years of experience with Amazon Web Services (AWS), either as an administrator or software developer
• 2-3 years of experience working with code analysis tools to analyze static, dynamic, and open source code
• 2-3 years of experience deploying Infrastructure as Code via Terraform, able to interpret CloudFormation templates
• Experience and knowledge of how to work in an Agile/Scrum driven environment
• In depth comprehension of OWASP Top 10 / SANS 25 and application security frameworks
• In-depth knowledge of application security concepts, best practices, and architectures for API, Microservices, networking and data DevOps tools, containerization and orchestration platforms (Docker, ECS, Fargate), code scanning tools and workflows
• Expertise in working with Product, Application Development, QA, and DevOps teams to mitigate and address application threat vectors
• Industry related certifications a plus (CISSP, CISM, GIAC, OSCP, etc.)
• Education Bachelors degree in Information Security, Computer Science, or similar degree preferred

Essential Duties And Responsibilities:

• Develop, operate and maintain processes and tools to identify, analyze, and remediate vulnerabilities and configurations that could negatively impact business, clients, and information.
• Work with software engineers to build secure architectures and patterns that can be implemented with minimal disruption
• Partner with Product, Engineering, QA, and Infrastructure teams to ensure security is part of the design process and proactively built into the clients products
• Analyze security concerns and follow through with issues until resolution
• Lead application security testing; participate in penetration testing, vulnerability management, and other assessments as directed
• Participate in additional team functions and rotating on-call schedule to support broader security tools and capabilities, including email, endpoint, perimeter, and cloud
• Respond to incidents and manage incident response as assigned
• Develop training, documentation and guidance for internal teams
• Work alongside other team members supporting the business by identifying and removing risks, threats, and anomalies in the environment
• Other security-related projects that may be assigned

Required Skills:

• Strong oral and written communication skills; ability to present findings and recommendations to leadership while diving deep into code with developers
• Strong interpersonal skills, with the ability to enable fellow staff through training, communication and mentorship
• Problem solving skills, with the ability to identify symptoms, root causes and possible solutions to challenges, identifying and creating plans to implement the most effective solutions