Security Engineer

Security Engineer/Tester

As a Security Engineer/Tester, you will be performing authorized security testing on some of the very complex, massive scale, and highly critical applications. As part of a shift-left focus, you will work with the development team along with developers to proactively identify any security vulnerabilities (OWASP Top 10, SANS Top 25, CWE) at the earliest before they are discovered late in the cycle by InfoSec teams or in production. You will serve as a liaison between the InfoSec team and development teams, understanding the security issues reported by central InfoSec teams to development teams to help them understand and fix them. You need to be highly passionate about following the constantly changing threat landscape and familiarizing yourself with the latest security vulnerabilities that impact the team.

Role Responsibilities

• Perform authorized security testing on complex, large-scale, and highly critical applications.
• Work independently and as part of a team in a fast-paced environment.
• Be aware of varied application security domains like authentication, authorization, identity management, cryptography, etc.
• Communicate and present findings to Leadership/Management/Development teams to help them understand the risk and make informed decisions on mitigations, controls, and residual risk.
• Be a team player, self-starter, and quick learner with 3 years of experience in software development/testing with large-scale enterprise applications.
• Highlight examples of quick learning on the resume when submitting a candidate under this consideration.

Required Qualifications

• 3 years of experience in software development/testing with large-scale enterprise applications.
• Primary skill – manual and automated testing (testing will be done on software).
• Deep understanding of different web application technologies, web protocols ( etc.), browser technologies, etc.
• In-depth domain understanding of application security in terms of Identity and Access Management (IAM), different authentication technologies (passwords, biometrics, OTP, digital certificates & PKI, device authentication, FIDO U2F/Passkeys, etc.).
• Proven expertise in different security testing tools (Proxy tools like Fiddler, Black box security testing tools like Burp, Static Security Code analysis tools).
• Deep understanding of different application security vulnerabilities such as OWASP Top 10, SANS Top 25, CWE, attack patterns (CAPEC), etc.
• Bachelor's Degree in Computer Science or equivalent experience.
• Must be self-directed, able to work independently, as well as work in a team-oriented and fast-paced environment.

Desired Qualifications

• Working experience on different security technologies and standards like Single Sign On (SSO) using SAML/OpenID, OAuth protocols, etc.
• Good understanding of Cryptographic algorithms and standards like Symmetric/Asymmetric crypto techniques, digital signatures, JWS/JWE tokens, Hardware Security Modules (HSMs), etc.
• Understanding of security vulnerabilities related to Cloud environments is an added advantage.
• Well-known security certifications are an added advantage.
• Understanding of Threat Modelling concepts and Secure Development Life Cycle processes.
• Mobile Application Security familiarity is desirable.