Application Security Developer III
About The Position
The Application Security Developer III supports the Application Security Program through application security testing, analysis of security tool output, documentation of security findings, production of proof-of-concept exploits, and software development. The role performs security testing on web applications, web services, and mobile applications; reviews source code with a security focus; and maintains and improves DAST/SAST tools and processes. The position also designs and develops software to support, automate, integrate, and augment security tools and processes. It participates in solution design to provide security guidance and build awareness, and works closely with software development teams to integrate application security solutions such as Web Application Firewalls and OAuth/OIDC providers. The role operates in a distributed team whose members work across multiple locations and often communicate virtually.
Requirements
- Bachelor of Science in computer science or software engineering, or equivalent years of relevant work experience.
- Five years of software development experience.
- Skilled in software development and working with JavaScript, Python, Golang, C#, PHP, Ruby, Java, PowerShell, and TSQL.
- In-depth understanding of the HTTP protocol and web hosting platforms.
- Understanding of basic networking and network troubleshooting.
- Good understanding of OAuth and OIDC.
- Knowledge of Windows, OSX, Linux, iOS, and Android operating systems.
- Competent in software troubleshooting.
- In-depth understanding of common application exploits, including SQLI, XSS, CSRF, RCE, XXE, SSRF, and the OWASP Top 10.
- Knowledge of specific phases of the software development life cycle.
- Strong interpersonal skills, including excellent written and verbal communication skills.
- Knowledge of configuration management tools, scripting, programming, and automated testing tool sets.
- Flexible and adaptable in learning and understanding new technologies.
- Highly self-motivated and directed, technically proficient, highly logical, and attentive to detail.
- Analytical and problem-solving abilities.
- Ability to effectively prioritize and execute tasks independently and in a team-oriented, collaborative environment.
- Innovative and pioneering spirit.
Nice To Haves
- Experience performing application security testing.
- Experience developing and designing n-tier applications with multi-tier architectures.
- Knowledge of BurpSuite, ZAP, or other application security testing tools.
- Knowledge of DAST and SAST products.
- Offensive Security Certified Professional (OSCP) or Offensive Security Web Expert (OSWE) certification.
Responsibilities
- Perform application security testing against web applications, web services, and mobile applications using BurpSuite and other tools.
- Analyze DAST and SAST output and determine exploitability.
- Report security findings, including proof-of-concept exploits and remediation steps.
- Maintain and improve DAST/SAST tools and processes.
- Perform security-focused source code reviews.
- Design and develop software to support, automate, integrate, and augment security tools and processes.
- Participate in solution design by providing security guidance and creating awareness.
- Work with software development teams to integrate application security solutions, including Web Application Firewalls and OAuth/OIDC providers.
- Work in a distributed team environment, communicating virtually with team members across numerous locations.
- Perform other job-related instructions as requested.
Benefits
- A bonus tied to company and individual performance may be available.
- A substantial and comprehensive total rewards package focused on employee well-being.
Stand Out From the Crowd
Upload your resume and get instant feedback on how well it matches this job.
What This Job Offers
Job Type
Full-time
Career Level
Mid Level
