Senior Security Engineer - Red Team (Remote)

What You Will Do

• performs web, mobile application, and internal penetration tests, source code reviews, threat analysis, social-engineering assessments,
• supports blue teams when needed,
• researches new attack vectors and stays current with cybersecurity news and trends,
• trains Quality Assurance and Development teams in standard security testing techniques and secure software development.

What You Will Need

• have 4+ years of working experience in web application security,
• have hands-on experience in security testing of web applications, web services, mobile applications, APIs, etc.,
• have experience securing REST APIs and web services,
• have experience using and implementing SAST / DAST tools such as Fortify, Veracode, Checkmarx, or other similar tools,
• know how to conduct penetration tests of information systems using commercial and open-source exploitation tools,
• have a good understanding of standard security vulnerabilities and common remediation as published by OWASP, SANS, etc.,
• have experience working with secure coding methodology and best practices and their implementation within engineering teams,
• will support developers of our business units in their SDLC and provide guidance regarding mitigations to emerging threats,
• will review application source code based on static application security testing tools,
• will be engaging in security research to remain current on vulnerabilities and testing tools,
• will be creating detailed, professional documentation/reports that clearly communicate vulnerabilities, mitigation strategies, and remediation steps,
• have the ability to work on multiple projects concurrently and be committed to providing exemplary customer service,
• have strong written and verbal communication skills in English,
• have Python, JavaScript, PHP programming experience as a plus,
• have knowledge in scripting (any language) and experience in automation scripts for application security testing as a plus,
• have familiarity with cloud security, particularly AWS security concepts, as a plus,
• have certifications such as eWAPTx, OSCP, OSWE, etc., as a plus,
• are able to work in a team-centric environment,
• have strong critical thinking and analytical skills,
• have experience in executing white, gray, or black box security posture assessments and completing detailed reports that outline the findings and recommendations.