Senior Security Consultant, Application Security
About The Position
The Senior Consultant, Application Security is a senior technical practitioner in IOActive's Application Security practice, with secure code review as the central specialty. The role focuses on manual code audits across web and systems languages, alongside application penetration testing, threat modeling, secure design reviews, and Secure Development Lifecycle (SDLC) advisory engagements. Work may cover production source code for enterprise web applications, mobile backends, APIs, embedded systems, and cryptographic implementations. The consultant leads complex engagement delivery, communicates technical findings and business risks to developers and security leadership, and builds trusted relationships with client engineering and security teams. The role also includes mentoring consultants, contributing to practice methods and tooling, supporting pre-sales work, and participating in application security research and industry activities. IOActive offers remote or office flexibility as needed and opportunities for travel.
Requirements
- At least 5 years of experience in offensive security services, including at least 2–3 years focused on application security and source code review.
- Hands-on engagement delivery across multiple application security disciplines, such as code review, application penetration testing, threat modeling, or SDLC consulting.
- Deep code review expertise in at least two of the following: JavaScript/TypeScript, Python, Java, C#/.NET, C/C++, Rust, or Go.
- Working knowledge of common framework patterns, ORM behavior, authentication and authorization libraries, cryptographic libraries, and their security pitfalls.
- Strong technical credibility and the ability to operate as the senior technical voice on engagements.
- Excellent written communication skills, including producing reports that developers can act on.
- Strong verbal communication skills and the ability to present technical material and explain complex concepts to general audiences.
- Comfort working across different languages and technology stacks.
- Collaborative approach and ability to coordinate closely with delivery teams and client developers.
- Curiosity about how systems work and patience for careful code review.
- Relevant bachelor's degree or equivalent experience.
Nice To Haves
- Working competence in additional programming languages beyond the two in which deep code review expertise is required.
- Familiarity with OWASP ASVS, NIST SSDF, BSIMM, or SAMM.
- Relevant industry certifications, such as OSCP, OSWE, GWAPT, CSSLP, GWEB, or equivalent application-security-focused credentials.
Responsibilities
- Lead manual source code reviews on complex production codebases spanning web applications, mobile backends, APIs, and embedded systems.
- Identify common and nuanced vulnerabilities, including injection, authentication and authorization flaws, SSRF, XSS, deserialization issues, race conditions, cryptographic implementation flaws, business logic vulnerabilities, and architectural weaknesses.
- Write actionable findings reports with remediation guidance, proof-of-concepts where appropriate, and architectural recommendations.
- Lead developer workshops to explain findings and security patterns.
- Conduct application penetration testing across web, API, and mobile targets.
- Perform threat modeling for new product designs and existing systems using STRIDE, attack trees, or equivalent frameworks.
- Conduct secure design reviews of architecture, authentication systems, cryptographic implementations, and inter-service communication.
- Advise clients on integrating code review, threat modeling, and security testing into SDLC processes, including CI/CD, pull-request workflows, and developer training.
- Serve as the senior technical voice in engagement status meetings, client workshops, technical deep-dives, and developer training.
- Build technical relationships with client engineering leadership, AppSec teams, and security architects.
- Translate technical findings for developers and security leaders, including explaining business risk and recurring patterns.
- Support pre-sales work through scoping calls, capability discussions, and proposal input.
- Mentor junior and mid-level consultants in code review methodology, vulnerability research, and client engagement.
- Contribute to code review playbooks, tooling, methodologies, and report templates.
- Identify opportunities to extend IOActive's AppSec capabilities, including tooling, target stacks, research directions, or services.
- Collaborate with adjacent practices such as Red Team, Hardware/Silicon, and Advisory on composite engagements.
- Contribute to application security research, including vulnerability discovery, novel attack techniques, and framework- or platform-specific findings.
- Build a profile in the application security community through conference talks, published research, and working group participation.
- Represent IOActive in AppSec industry conversations, open-source security efforts, and customer advisory engagements as opportunities arise.
Benefits
- Access to world-class technical teams and research.
- A high-energy, collaborative team that values innovation.
- Flexibility to work remotely or from the office as needed.
- Opportunities for travel.
- Competitive compensation and performance-based incentives.
Stand Out From the Crowd
Upload your resume and get instant feedback on how well it matches this job.
What This Job Offers
Job Type
Full-time
Career Level
Senior
