Description

Perform manual and automated code reviews to identify and remediate vulnerabilities in Java and Scala applications. Integrate and automate security tools within CI/CD Jenkins pipelines. Conduct static, dynamic, and penetration security testing of Web Applications and REST APIs using BurpSuite Pro. Execute third-party library security assessments and dependency analysis. Write comprehensive reports detailing findings and provide mitigation recommendations to application owners. Collaborate with development teams to define and enforce application security best practices and requirements.

Responsibilities

• Perform manual and automated code reviews of Java and Scala applications to find vulnerabilities like CSRF, XSS, SQL Injection, and Privilege Escalation.
• Conduct static, dynamic, and penetration security testing of Web Applications and REST APIs using BurpSuite Pro.
• Execute third-party library security assessments and dependency analysis.
• Integrate and automate security tools within CI/CD Jenkins pipelines.
• Write comprehensive reports detailing findings and provide mitigation recommendations to application owners.

Required Skills

• 3+ years of hands-on application security penetration testing experience using BurpSuite Pro.
• 2+ years of experience in vulnerability and risk assessments, security policy development, and technical security architecture.
• Deep understanding of OWASP Top 10 and SANS 25.
• Proficiency in Java, JavaScript, Python, or UNIX shell.
• Hands-on experience automating security tools in Jenkins, specifically OWASP ZAP, Nessus, Fortify, or Sonatype Nexus.
• Experience with Secure SDLC, DevSecOps principles, and Cloud security best practices.
• Familiarity with compliance frameworks such as NIST 800-Series, DIACAP, FISMA, FedRAMP, or FIPS.
• At least one recognized security certification (CISSP, GWAPT, CEH, LPT, or CCSP).

Preferred Skills

• Experience working within DevOps processes and CI/CD environments.

Key Skills

Education

Any Graduate