Senior Cloud Application Security Engineer
Remote
Job Summary
Triage security findings from Bug Bounty, automation tools, and self-discovery while supporting Triage and Remediation automation workflows. Design and contribute to Secure Software Development Life Cycle (SSDLC) practices, including code reviews, static/dynamic analysis, and self-service security services fully orchestrated within the CI/CD pipeline. Build and deploy security capabilities to secure application code, define application security policies meeting regulatory requirements, and introduce commercial open-source solutions to monitor production web services and APIs. Review security event logs to support incident response and contribute to blameless postmortems. Define and operate a vulnerability management program with dynamic reporting. Assist with writing Web Application Firewall rules and research vulnerabilities to recommend pragmatic remediation instructions.
Required Qualifications
- 3 or more years of experience securing large-scale web/mobile applications and APIs
- 2 or more years of software development experience
- 7+ years of Enterprise Information Technology or Information Security experience
- Familiarity with modern software engineering practices and continuous integration and delivery
- The ability to effectively partner and communicate with engineering and product teams
- The ability to leverage a language to develop Lambda functions and automate security acceptance testing and integrations
- Experience with Terraform or CloudFormation
- Understanding of the OWASP Top 10, CWE/SANS top 25, the OWASP Cheat Sheet Series, and other industry leading application security practices
Desired Qualifications
- Experience with Node.js, Java, React or Scala and iOS and/or Android apps
- Familiarity with dynamic and static application security tools
- Experience with threat modeling web services
- Experience securing applications within immutable infrastructure such as Kubernetes, containers, and microservices
- Desirable Certifications: GWAPT, GWEB
Hiring someone like this?
Get your role in front of qualified candidates on Sorce.