Description

You will test, advise, and consult on application security for internal and external web systems and applications.

Responsibilities

• Perform manual source code reviews and bug hunting to identify vulnerabilities such as XSS, CSRF, SSRF, and RCE.
• Conduct threat modeling, risk analysis, and penetration testing to secure attack surfaces.
• Write formal security assessment reports and communicate findings to Security, Dev, and Ops teams.
• Verify findings with application development teams and assist in remediation efforts.

Required Skills

• Proficiency in coding with C#, Python, Ruby, Perl, Go, PHP, and SQL.
• Hands-on experience with static code analysis, container security, authentication, and session management.
• Experience using penetration testing tools including Burp Suite, Metasploit, and WebInspect.
• Knowledge of security frameworks such as SSDLC, MITRE ATT&CK, NIST CSF, and OWASP Testing Guide v4.
• Understanding of web service technologies including XML, JSON, SOAP, and REST.
• Working knowledge of network protocols such as TCP/IP, UDP, IPSec, HTTP/S, and BGP.
• Experience with vulnerability management, threat vector analysis, and incident response.
• Familiarity with security compliance regimes including NIST, PCI-DSS, ISO 27000, and CIS.
• Ability to obtain a Public Trust Clearance.

Preferred Skills

• Background in J2EE, web frameworks, and .NET.
• Experience with AppScan Source, Fortify, Veracode, Sonatype, or Blackduck platforms.

Key Skills

Education

Any graduate