Application Security Developer III

Job Summary:

The Application Security Developer III is responsible for supporting the Application Security Program through application security testing, analyzing security tool output, documenting security findings, producing proof of concept exploits, and software development.

Essential Functions:

• Perform application security testing against web applications, web services, and mobile applications using BurpSuite and other tools
• Analyze and determine exploitability of DAST and SAST output
• Report security findings including proof of concept exploit, and remediation steps
• Maintain and improve DAST/SAST tools, and processes
• Perform security focused source code reviews
• Design and develop software to support, automate, integrate, and augment security tools and processes
• Participate in solution design to provide security guidance and create awareness
• Work closely with software development teams to integrate application security solutions, i.e., Web Application Firewalls and Oauth/OIDC providers
• Work in a distributed team environment where team members are spread across numerous locations and often communicate virtually
• Perform any other job-related instructions as requested

Education and Experience:

• Bachelor of Science in the field of computer science or software engineering or equivalent years of relevant work experience required
• Five (5) years software development experience
• Experience performing application security testing is preferred
• Experience developing and designing n-tier applications with multi-tier architectures is preferred

Competencies, Knowledge and Skills:

• Skilled in software development and working with javascript, python, golang, C#, php, ruby, java, powershell, and TSQL
• In depth understanding of the HTTP protocol, and web hosting platforms
• Understanding of basic networking and network troubleshooting
• Knowledge of Burpsuite, ZAP or other application security testing tools is preferred
• Knowledge of DAST and SAST products is preferred
• Good understanding of Oauth and OIDC
• Knowledge of Windows, OSX, Linux, iOS, Android operating systems
• Competent in software troubleshooting
• In depth understanding of common applications exploits (SQLI, XSS, CSRF, RCE, XXE, SSRF) and OWASP top 10
• Knowledge of specific phases of the software development life cycle
• Strong interpersonal skills including excellent written and verbal communication skills
• Knowledge of configuration management tools, scripting, programming and automated testing tool sets
• Flexible and adaptable in regards to learning and understanding new technologies
• Highly self-motivated and directed, technically proficient, highly logical with strong attention to detail
• Analytical and problem-solving abilities
• Ability to effectively prioritize and execute tasks while working both independently and in a team-oriented, collaborative environment
• Innovative and pioneering spirit

Licensure and Certification:

Offensive Security Certified Professional (OSCP) certification or Offensive Security Web Expert (OSWE) certification preferred

Working Conditions:

General office environment; may be required to sit or stand for extended periods of time