Role and Responsibilities

Develop a broad and deep technical understanding of products, services and architectures.
Leverage this understanding to conduct architecture reviews, threat modelling and code reviews on web applications, mobile applications and other relevant services.
Work with developers to refine security checkpoints in Development cycle that are based on industry-accepted security standards and represent Security Platform in development at various stages of SDLC.
Interpret security tools and penetration testing results to stakeholders, providing advice on vulnerability remediation and risk mitigation.
Create relevant documentation and metrics to your stakeholders and business leaders and deliver these in a clear, concise manner.
Research and maintain proficiency in attacker Tools, Techniques, Procedures and other security topics.
Propose and develop training materials to help raise the security bar across the organization.
Develop innovative and scalable tools, solutions, and processes to enhance product security operations

Qualifications and Education Requirements

· Computer Software Bachelor

· OSCP or equivalent

· eWPT

· az-104

· az-204

· az-303

· az-500 ( is a plus)

3+ years of experience in web application security, SSDLC, Threat Modeling
Experience implementing, running and maintaining tools and/or processes to reliably identify security issues such as SQLi, XSS, CSRF, and business logic flaws across large code bases (SAST, DAST, Pentesting, Security Unit Testing, etc.)
Good understanding of system architecture, TCP/IP Networking, Build Process and DevTestSecOps.
Experience of using and customizing SAST/DAST/Penetration testing with tools like Veracode and IBM ASOC and Networking tools like Wireshark, Fiddler, Zap Proxy etc.
Knowledge of Secured Programming in high-level languages like web application, javasceript, C# and Python.
Knowledge of OWASP best practices and guidelines, Threat Modelling, Network Security and Encryption.
Knowledge of security monitoring, threat detection and incident response handling.
Experienced in working with Cloud Environment (Azure/AWS/Google preferred)
Skills in Security Audit & Compliance-Vulnerability Assessment and Penetration Testing-Cloud
Ability to triage, reproduce, recommend remediations and implement fixes for vulnerabilities
Passion for understanding and researching vulnerabilities and exploitation techniques
Knowledge of development and integration tools and technologies (e.g., CI/CD)
Knowledge of test automation frameworks and how they can be brought to bear for security QE
Practical knowledge of applied cryptography and common attacks against modern cryptographic algorithms (encryption at rest, TLS, hashing, etc.)
Ability to work in a self-directed environment that is highly collaborative and cross functional
Educate application developers to enhance quality of security in the code
Programming experience with Java web application & Python
Knowledgeable regarding backend security topics such as secret management and service authentication
Perform penetration tests and coordinate third-party vendor Pentests
Rating the severity of defects and publishing comprehensive reports detailing associated risks and mitigations

Nice to Have

B.S. Computer Science or similar combination of education and experience
Strong software development experience/exposure (Java, iOS and Android APIs, Web, Python)
Good communication skills
Have an excellent working knowledge and ability to educate others on common vulnerability types, including SQL/command injection, XSS, CSRF, and SSRF
Have experience in web, database, information and/or infrastructure security
Know and love learning about the latest security tools, infrastructure, and industry best practices
Enjoy working across and being a resource for other engineers and sharing your knowledge of secure coding practices
Experience in authentication and authorization: SAML, OAuth, LDAP, AD, etc.
Sound understanding of app security vulnerabilities, defense techniques and security best practices, including language-specific security measures and present-day threats
Passion for security. We’re looking for people who genuinely care about working to create a secure product with modern, agile facing practices.

Cybersecurity Bradley & Rollins

New Jobs

Penetration Tester