Senior application security analyst
Summary
Conduct security testing and audits for a major European telecom's applications using SAST/DAST tools, manual penetration testing, and vulnerability assessments. Requires Java/Python skills, knowledge of OWASP Top 10/CWE, and 2+ years in AppSec.
Project description
We are a team of Application Security enthusiasts who have been helping create secure applications for a huge telecom provider in Europe for over 15 years. We know how to break apps and how to make them unbreakable.
Responsibilities
- Development of security requirements at early stages of the product life cycle.
- Preparation of test scenarios for an audit that are based on business requirements, technical documentation for a project and a list of affected systems.
- Identification of defects and vulnerabilities in new and existing software products using the following methods: - Static code analysis (mainly Java and J2EE applications, iOS and Android mobile apps) using HPE-MicroFocus Fortify SCA; - Dynamic code analysis and scanning for vulnerabilities using Burp Suite and OWASP ZAP; - Manual penetration tests on software products deployed on a test environment.
- Development of recommendations for software developers for addressing the security flaws identified.
- Optimization and automation of the audit process.
- Configuration (creation of new rules) of SAST and DAST tools.
SKILLS
Must have
- Understanding of architecture and working principles of modern web applications.
- English level: Upper- Intermediate.
- Higher education in IT or math
- Strong knowledge of basic concepts of information security.
- Strong knowledge of defect types (CWE/SANS Top 25 Most Dangerous Software Errors), vulnerabilities and information security risks in web and mobile applications (OWASP Top 10), as well as ways of detecting and mitigating them.
- More than 2 years of working experience as Application Security Engineer or on a similar position (Penetration testing, etc.).
- Strong knowledge of programming languages (Java) and scripting languages (Python, powershell, bash).
Nice to have
• Relevant information security certifications: OSCP, CEH, OSWE. • Knowledge of/experience with international information security standards and personal data protection standards: ISO 27XXX, PCI DSS, GDPR, etc. • Knowledge of/experience with information security standards and frameworks: SAML, OAuth, WS-Security, X.509, SAML, JAAS, SSL/TLS, OpenSSO, OpenIAM, etc. • Experience in CTF or bug bounty programs. • Experience in web or mobile apps development.